Eichstätt confirms ransomware; The Gentlemen claim theft of 1.5 TB
The Gentlemen ransomware group listed the town of Eichstätt, Upper Bavaria, on its leak site, claiming about 1.5 TB of stolen municipal administration data. The city itself confirmed the breach on the night of Oct 8 to 9: files encrypted and data copied, and Bavarian police located the copied data on a server abroad. Town hall is running in emergency mode, rebuilding systems from backups, and says it will not pay.
What happened
The Gentlemen group listed the town of Eichstätt (Upper Bavaria) on its leak site, claiming about 1.5 TB of stolen municipal data. The city confirmed the breach: on the night of Oct 8 to 9, intruders encrypted files and copied data from town hall systems. Bavarian police found the copied data on a server abroad.
Why it matters
Town hall is running in emergency mode while systems are rebuilt from backups, disrupting municipal digital services. The city has not said whether residents' personal data is in the stolen set, and the leak-site listing suggests a publication deadline is running, according to DailyDarkWeb. Suppliers and residents may receive phishing that uses real municipal records.
What to do
If your company is a supplier or shares data with the town, map what could be exposed and verify contacts and payments through a confirmed channel. Warn staff about emails citing real municipal records. Follow the city's official statements on the data contents.
For the technical team
- Affected
- Prefeitura de Eichstätt (cidade da Alta Baviera, Alemanha); sistemas da administração municipal · Town hall systems of Eichstätt (municipal administration, Upper Bavaria). Third-party software cited as the likely entry point, not identified in the sources.
- Exploitation
- Attack confirmed by the victim: file encryption and data copying on the night of Oct 8 to 9. The Gentlemen claim about 1.5 TB stolen; the figure and attribution are not independently verified. Bavarian police located the copied data on a server abroad.
- Fix
- No applicable fix stated in the sources. The town is rebuilding systems from backups and keeps town hall in emergency mode.
- Vector
- The city says intruders most likely came in through a flaw in third-party software it used; it rules out phishing and says 2FA was in place. The software is not identified in the sources and the exact exploitation condition was not detailed.
- More details
- The city says it will not pay. It is unclear whether residents' personal data is in the stolen set. DailyDarkWeb analyst note: a leak-site listing usually means a publication deadline is running; expect targeted phishing using real municipal records. Single source: DailyDarkWeb on X.
Timeline
Incident opened after the group listed the town and city hall confirmed the Oct 8-9 night intrusion.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
