A Utility Loses Its Office and Keeps the Water On

Stadtwerke Landsberg, the municipal utility for a Bavarian town, disclosed on 8 September that its central IT network and office systems had been encrypted in an attack that began overnight on 1 September. The operator stated that electricity, water and other essential services were not affected. Staff were reachable only to a limited extent by phone and email while external specialists conducted a forensic investigation. Customers were warned that personal data — names, addresses, phone numbers, email addresses and bank details — may have been accessed or stolen. The utility did not name the group responsible or confirm whether an extortion demand had been received.

The detail worth dwelling on is the one presented as reassurance. Supply continued because the operational systems that run distribution were not reachable from the network that was encrypted — which is the separation working exactly as it is supposed to, and is a better outcome than many comparable incidents. It is also a narrower claim than it sounds. A utility that has lost its office systems has lost billing, procurement, scheduling, document management, the ability to dispatch work orders and, in many cases, the historian and reporting systems that sit on the IT side of the boundary. Supply continues; running the business does not.

The seven days between the attack and the disclosure are the second thing worth noting, and they are not evidence of concealment. That interval is roughly what it takes to establish what was encrypted, what was exfiltrated and which customer records were in scope — and the data notification, which is the legally consequential part, cannot be issued accurately before that work is done. Organisations planning for this should assume the same shape: a week of not knowing, during which the operational question and the disclosure question run on different clocks.

For any utility or industrial operator, this incident is a short checklist rather than a warning. Can distribution or production actually run for a week with the corporate network gone — including the manual fallbacks for dispatch, meter reading and emergency callout? Are backups for the office systems held somewhere the encryption could not reach? Is there a communication route to customers that does not depend on the systems most likely to be lost? And is the boundary that protected the operational side here an enforced one, or does it depend on the fact that nobody has yet needed a convenient route across it? The answer to that last question is what separated this utility from the ones whose supply does stop.