Cyberattack on Vienna: 26,000 documents and data from 6,000 people stolen
Unknown attackers gained access to the IT system of the City of Vienna and copied around 26,000 internal documents. Data from almost 6,000 people were affected.
Vienna city administration victim of data breach
The City of Vienna became the target of a cyberattack: unknown perpetrators copied around 26,000 internal documents totalling nine gigabytes from a municipal documentation platform. Vienna's Chief Information Officer (CIO) Klemens Himpele reported this to the APA, as reported by Kleine Zeitung.
Data from almost 6,000 people were affected — including around 2,000 municipal employees, approximately 2,900 citizens as well as more than 800 contractors of the city. In most cases these were names and email addresses. In some cases, however, more sensitive information such as sick leave days or IBAN numbers may also have been copied.
Security gap reported via CERT
According to Himpele, Vienna City Hall first received information about the incident on 9 September via the Austrian Computer Emergency Response Team (CERT). Previously, access to a vulnerability in the city's system had apparently been offered for sale on an online forum. In cooperation with the Directorate for State Security and Intelligence Services (DSN), the gap was subsequently identified and closed.
According to an analysis, the perpetrators gained access to an internal documentation platform where information on training and project documentation was stored, among other things. A special scanning AI that searches for vulnerabilities for so-called data breaches is considered a possible attack tool. A phishing attack is currently being ruled out.
No control of systems obtained
According to Himpele, there was no direct access to the city's IT infrastructure. At no point did anyone gain control of systems or user accounts, he stressed. According to current knowledge, the stolen information was not published; the city was also not extorted.
The attack was reported to the data protection authority. The affected people will now be notified. "We can only apologise," said Himpele. He emphasised that data security is of high importance to the city and that in the event of a data breach, all necessary measures would be taken immediately.
Source: Kleine Zeitung