Region: dach
50 entries covering the dach region, latest activity first.
- Berlin's state government confirms an extortion attempt after a phishing click opens the shared Landesnetz; media reporting names Rhysida
- CVE-2026-102489 / CVE-2026-102490, Zammad helpdesk: a session-hijack remote code execution and a zammad-to-root escalation, both reported exploited since 21 September; 7.2.2 fixes the root flaw on DEB and RPM installs
- Tangerhütte (Saxony-Anhalt): the vendor of the municipal citizen-portal software says attackers exploited a zero-day in it, classifies the intrusion as AI-driven, and four other communes took their portals offline
- FTAPI, a file-transfer vendor whose customers include authorities, confirms ransomware on an internal server; The Gentlemen list it on their leak site
- Stadt Wien discloses 26,000 documents copied from an internal documentation platform; Austria's CERT.at reported a forum offer to buy a vulnerability in a city system
- 22 CVEs in Tobit TeamDavid, a DACH-region self-hosted Microsoft 365 alternative: an unauthenticated heap leak hands over stored mailbox passwords, and Rollout 528 disables the affected function
- Flink refuses a corporate ransom after an Order Hub breach, so extortion actor "LPG Group" pivots to crowdfund-style individual extortion of at least 10,000 customers
- Austria's NISG 2026 creates the Bundesamt für Cybersicherheit, 24h/72h incident-reporting clock live 1 October 2026
- Swiss Bitcoin Pay (Neuchâtel) shuts down its servers after a suspected intrusion, saying IBANs, wallet addresses and hashed passwords may have been accessed
- Salt confirms misuse of an existing access credential to an unnamed 'peripheral system', up to 1.09 million Swiss mobile customers' records reportedly at risk
- Liechtenstein's beneficial-ownership register breached: copies of ~31,000 legal entities' records taken, and four more e-government systems pulled offline as a precaution
- Six Swiss cantons disclose bulk-harvesting of vehicle-owner data after an unknown actor bypassed per-person rate limits on public lookup portals, with extortion attempts against the platform operator and canton Vaud
- German mobile carriers leaked callees' IMEI, device model and OS version to callers during call setup, GSMA confirmed the flaw and warned its 1,000+ member operators worldwide
- Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
- PTC Windchill CVE-2026-12569: unauthenticated Java deserialization to RCE on the PLM management plane
- A German federal- and state-funded memorial foundation is rebuilding its entire IT from scratch after ransomware, all seven sites offline, data assumed exfiltrated, no actor named
- CVE-2026-7849 and 19 more, Phoenix Contact CHARX SEC-3xxx EV charging controllers: unauthenticated command injection as root, unsigned firmware updates, and no fix released at disclosure
- Everest ransomware breaches a Stadler Rail supplier data-exchange platform, demands CHF 10 million, the Swiss rail manufacturer refuses to pay
- AIVD/MIVD: Russia-linked actors hijack default-credential IP cameras along NATO military-supply routes to monitor Ukraine-bound shipments
- CVE-2026-20896: Gitea's official Docker image trusted the reverse-proxy login header from any source, so where reverse-proxy authentication is enabled anyone can impersonate any user
- Nextcloud GmbH's own hosting infrastructure exposed 367K internal records via a misconfigured public Elasticsearch cluster, including client setup scripts with hardcoded credentials
- Deutsche Bank confirms a third-party vendor incident after 'Unsafe' ransomware group posts alleged employee data
- CERT Polska: UNC1151/Ghostwriter shifts to Gmail with real-time 2FA-relay phishing against officials and public administration
- CVE-2026-52806, Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch)
- "The Gentlemen" ransomware claims 478 victims and adds worm propagation, Switzerland the second-most-targeted European country
- Ubiquiti UniFi OS triple-flaw chain to unauthenticated root (CVE-2026-34908 / -34909 / -34910)
- CVE-2026-12789, ILIAS 11.0: unpatched, PoC-public SQL injection in the learning-progress subsystem (DACH education exposure)
- BSI flags 13 vulnerabilities patched in Zammad 7.1, admin privilege escalation in a DACH public-sector helpdesk platform
- Novo Nordisk discloses theft of clinical-trial and healthcare-professional data
- Munich: ~120,000 student records suspected on the darknet, terminated employee under investigation
- CVE-2026-47344 et al. TYPO3 core June release: 13 CVEs across every supported branch (10.4 ELTS → 14.3 LTS)
- Proofpoint TA4922: a China-nexus cybercrime cluster expands from Japan into Germany, the UK and Italy with native-language lures and DLL-side-loaded Atlas RAT
- DesckVB RAT malspam launders through Google DoubleClick and blinds AMSI/ETW, with German-language lures aimed at DACH
- Mautic 7.1.2 / 6.0.9, seven authenticated flaws, including two post-auth RCE paths (SSTI and path-traversal-to-PHP-RCE), an SSRF and an API authorization bypass
- Germany's federal cabinet approves the Cybersicherheitsstärkungsgesetz, BKA, BSI and Federal Police gain authority to redirect traffic and disable attacker infrastructure
- ILIAS LMS, nine fixes shipped 2026-05-27, two critical access-control gaps (CVSS 9.8 + 9.3), NCSC.ch flags SOAP interface as primary unauthenticated attack surface
- Six German university hospitals lose ~97,600+ patient records to a breach at billing processor Unimed
- Rhysida claims Stuttgart municipal-data theft for 5 BTC; city denies a confirmed incident
- SEPPmail Secure E-Mail Gateway: unauthenticated code execution and five more flaws in NCSC-CH's advisory (CVE-2026-44128 et al., CVSS up to 9.3), fixed by 15.0.4
- BigBlueButton bbb-web before 3.0.21 and 3.0.23: predictable session tokens, an API checksum bypass and an SSRF (CVE-2026-46351, CVE-2026-46353, CVE-2026-46404)
- ARWINI, Lower Saxony's prescription audit body: police confirm a data outflow and name the Kairos group, which lists 2.87 TB for sale
- Kaspersky: Kimsuky adds Rust-based HelloDoor and httpMalice to its PebbleDash toolkit and takes over hosts through VSCode tunnels and DWAgent
- Suspected Dream Market main administrator "Speedstepper" arrested in Germany; US indictment traces reactivated marketplace wallets and gold purchases
- Škoda Auto Deutschland accessories-shop breach: attackers exploited the shop software, customer data and password hashes were accessible, logs cannot show what was copied
- BKA and ZIT shut down the relaunched Crimenetwork darknet marketplace; suspected German operator arrested in Mallorca on a European Arrest Warrant
- BSI lists two authenticated pfSense CE code-execution flaws as critical: CVE-2025-69690 (CE 2.7.2) and CVE-2025-69691 (CE 2.8.0), disputed by Netgate
- DENIC .de DNSSEC outage: a faulty key rollover made all .de domains unresolvable for validating resolvers for more than three hours on 5 May 2026
- JDownloader website compromise: "Download Alternative Installer" and Linux shell installer links pointed to malware on 6 and 7 May 2026
- Berlin court orders Apobank to refund EUR 218,000 lost to a letter, QR-code and phone scam that enrolled the attackers' own device
- Qilin claims a ransomware attack on the German party Die Linke; the party has not confirmed data theft