Landratsamt deggendorf found that harmful software known as so-called ransomware had been installed on one of the corporate computers, posing a threat that all files would be locked.
After a bitcoin ransom was paid, a potential decryption was promised. There was no communication.
In the end, no encrypted or leaked data were discovered. Despite being targeted, the afflicted company was well-prepared for them.
In order to proactively remove and restore the files in the productive system, it was able to rely on the already-existing data backups. The business did not sustain any financial losses.
Source: https://www.polizei.bayern.de/aktuelles/pressemitteilungen/043519/index.html
TPRM report: https://scoringcyber.rankiteo.com/company/landratsamt-deggendorf
"id": "lan34914823",
"linkid": "landratsamt-deggendorf",
"type": "Ransomware",
"date": "02/2023",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'industry': 'Public Administration',
'location': 'Deggendorf, Germany',
'name': 'Landratsamt Deggendorf',
'type': 'Government'}],
'attack_vector': 'Ransomware installation on a corporate computer',
'data_breach': {'data_exfiltration': 'None'},
'description': 'Landratsamt Deggendorf discovered ransomware on one of their '
'corporate computers, threatening to lock all files. A bitcoin '
'ransom was paid, but no decryption was provided. No encrypted '
'or leaked data was found. The company relied on existing data '
'backups to restore the files and did not sustain any '
'financial losses.',
'impact': {'data_compromised': 'None',
'financial_loss': 'None',
'revenue_loss': 'None',
'systems_affected': ['Corporate computers']},
'initial_access_broker': {'entry_point': 'Corporate computer'},
'investigation_status': 'Resolved',
'lessons_learned': 'Importance of regular data backups',
'motivation': 'Financial gain',
'post_incident_analysis': {'corrective_actions': 'Utilization of data backups '
'for restoration',
'root_causes': 'Ransomware installation'},
'ransomware': {'data_encryption': 'None',
'ransom_demanded': 'Yes',
'ransom_paid': 'Yes'},
'recommendations': 'Ensure robust backup and recovery processes are in place',
'response': {'containment_measures': 'Reliance on data backups',
'remediation_measures': 'File restoration from backups'},
'title': 'Ransomware Attack on Landratsamt Deggendorf',
'type': 'Ransomware'}