Short answer
Eichstätt's city administration was hit by a ransomware attack in the night of 8 to 9 October 2026. The city says the attackers encrypted servers and copied data to a server abroad, and on 4 November it said about 1.4 terabytes, roughly a quarter of its data, was taken and may include personal details. It has not received a ransom demand and says it will not pay.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Stadt Eichstätt (City of Eichstätt) |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Local government |
| Country | Germany |
| Detected | 2026-10-09 |
| Disclosed | 2026-10-12 |
| People or records affected | Not stated as a headcount. About 1.4 TB copied, roughly a quarter of the city's data, per the city (nordbayern.de, 4 November) |
What data was exposed
- Phone numbers and addresses (assumed possible by the city)
- Bank and account details, including of current and former city employees (possible)
- Registration and tax data, for example land, dog and second-home tax (possible)
- Data of job, funding, building permit and land or housing applicants (possible)
- Adult education course participant and pension data (possible)
What happened
In the night of 8 to 9 October 2026, the city administration of Eichstätt in Bavaria was hit by a ransomware attack. The town hall’s IT systems were shut down and the building was closed for most visits. In an update on 22 October, the city said attackers copied most of its data to a server abroad before encrypting the servers, and threatened to publish it. This is known as double extortion.
What the city has said
The city says it received no explicit ransom demand and would not pay. It says daily backups worked and were checked for tampering before servers were restored. It cut access to the affected software vendor and moved to an emergency operating mode. The city’s utilities, the Stadtwerke, were not affected. Its working assumption on 22 October was an entry through a weakness in third-party software, despite two-factor authentication.
The scale, updated on 4 November
nordbayern.de reported on 4 November that, after analysis, the city believes the attackers copied about 1.4 TB, a good quarter of its dataset. About 1 TB is most likely an unstructured working directory. About 400 GB is still unclear because the attackers covered their tracks, and the city assumes personal data may be in it.
The city says complete or structured resident registration and financial databases are not affected, and that school and daycare administration data and registry office data are not affected. Individual personal records may still be in the copied files.
Who could be affected
The city names several groups as possibly affected. They are people who applied for city jobs, funding, building permits, or city-managed land or apartments. Current and former employees may have had financial data taken. Others are taxpayers who pay or paid land, dog or second-home tax, adult education participants, and people with pension or school-transport records. Phone numbers, addresses, ID numbers, bank details, registration and tax data may be involved.
Scam risks that follow
Municipal data is detailed and believable. A fake tax bill, a call about a building permit or a letter about a funding application can use true facts. See our guide on government impersonation scams and the checklist for what to do after a data breach. Messages that threaten publication unless you pay are extortion, and paying does not remove the data.
What is still unknown
It is unclear whether the attackers can open the copied files. No group had claimed the attack in the sources we read. The city plans a public information event on 11 November. See our other breach reports for similar incidents.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Letters, emails or calls in the name of the city that quote real personal details and ask for payment or information.
- Fake messages about tax, land or dog-tax bills that use real account data to look genuine.
- Unauthorised direct debits if bank details were in the copied data.
- Extortion messages to individuals threatening to publish their data.
What to do if you are affected
- 01Be cautious with any contact by email, letter or phone that refers to the city of Eichstätt, as the city advises. Check who is really writing before you reply.
- 02Check your bank statements for unusual debits. Contact your bank promptly about any debit you do not recognise.
- 03Join or read up on the city's digital citizen information event planned for 11 November, and use the FAQ at eichstaett.de/cyberangriff/.
- 04Never give a password, PIN or TAN to anyone who calls about the incident, and do not pay anyone who threatens to publish your data.
- 05If someone contacts you using your details, keep the message and report it to the police.
Frequently asked questions
How much data was taken from Eichstätt?
According to nordbayern.de on 4 November, the city said attackers copied about 1.4 terabytes, which it described as a good quarter of its total data. About 1 TB is most likely a copy of an unstructured working directory, and about 400 GB is still unclear.
Is my personal data in it?
The city says complete resident registration or financial databases are not affected, but individual personal records may be. People linked to job, funding, building permit or housing applications, tax payments, employment or adult education courses are named as possible groups.
Did the city pay a ransom?
The city said on 22 October that it received no explicit ransom demand and that it would not pay.
How did the attackers get in?
On 22 October the city said the attackers most likely got in through a weakness in a third-party software product, even though two-factor authentication was in place. It added that the attack was not a targeted attack on municipal government. This is the city's assessment so far.
Have the stolen files been published?
As of the city's 22 October update, no data had been published. We did not find a later claim in the sources we read.
Sources
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.