Tangerhütte digital town hall zero-day intrusion (September 2026)

Tangerhütte (Saxony-Anhalt): the vendor of the municipal citizen-portal software says attackers exploited a zero-day in it, classifies the intrusion as AI-driven, and four other communes took their portals offline

MDR AKTUELL reports on 2026-10-13 that the vendor of Tangerhütte's "digitales Rathaus" citizen portal says attackers found and exploited a vulnerability in its software that the vendor did not know of and for which no security update existed (MDR AKTUELL, 2026-10-13). The portal, an app-based service that went online in 2020, was taken offline in September, and MDR Sachsen-Anhalt reported on 2026-09-16 that the municipality said it had repelled an attack and gave no technical detail (MDR Sachsen-Anhalt, 2026-09-16). The software runs on systems that the state municipal IT provider KID operates for Tangerhütte; an IT employee noticed irregularities in the morning after the attack began at night, the server was isolated and cut from the internet, and the vendor analysed the secured logs on an offline notebook (MDR AKTUELL, 2026-10-13). Innocon told other affected communes, four of which also took their portals offline as a precaution although there was no sign of an attack on them, and says the attackers reached only test accounts and took no real data (MDR AKTUELL, 2026-10-13). Citizens could use the services only on paper for weeks (MDR AKTUELL, 2026-10-13).

The vendor classifies the intrusion as AI-driven for two reasons: commands were executed faster than copy-and-paste would allow, and the follow-on steps were not prepared in advance but developed on the city's server during the attack, whereas human attackers normally upload their own code and do not change it (MDR AKTUELL, 2026-10-13). That is the vendor's reading of its own logs. The state criminal police are investigating data espionage and can neither confirm nor deny an AI attack, and two professors told MDR the reading is plausible without having seen the logs (MDR AKTUELL, 2026-10-13). No CVE, product version, fixed release or entry vector is named.