Ransomware (extortion): IT service provider and software company, Germany 2023
At the end of October 2023, the Akira group encrypted systems of the municipal IT service provider; above all, 72 member municipalities were affected in their administrative services.
- Incident · 10.2023 · North Rhine-Westphalia (South Westphalia), Germany
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Attack via a supplier
As of
What happened
The attackers got into the network via a compromised VPN access; according to the service provider, no data was stolen and there was no contact with the perpetrators. The restart took months, and the investigations were later discontinued without the perpetrators having been identified.
- Affected
- Südwestfalen-IT
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / no
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Compromised VPN access (according to the forensic report)
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income if the cloud or a provider is attacked
Mostly limited 6 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
If a central IT service provider fails, all its customers come to a standstill; dependencies and emergency plans must cover this.
Sources
- Ransomware bei Kommunal IT-Dienstleister Südwestfalen-IT: Nachlese IT-Forensik-Bericht Teil 1 (opens in a new window) Borns IT- und Windows-Blog · 2024-01
- Ermittlungen zum Hackerangriff auf Südwestfalen-IT eingestellt (opens in a new window) it-daily.net
Similar cases
- Ransomware (extortion): IT service provider and software company, Switzerland 2026
- Ransomware (extortion): IT service provider and software company, Switzerland 2025
- Ransomware (extortion): IT service provider and software company, Switzerland 2023
- Ransomware (extortion): IT service provider and software company, Switzerland 2023