City of Vienna hit by cyberattack involving 26,000 documents

The City of Vienna has fallen victim to a cyberattack in which unknown actors gained access to an internal documentation platform. Approximately 26,000 internal documents, totaling nine gigabytes of data, were copied.

The breach affected data belonging to nearly 6,000 individuals, including roughly 2,000 municipal employees, 2,900 citizens, and over 800 contractors. While most compromised information consists of names and email addresses, there are indications that more sensitive data, such as IBAN numbers or sick leave records, may have been duplicated.

Vienna's Chief Information Officer, Klemens Himpele, stated that the vulnerability was identified and closed in cooperation with the Directorate for State Security and Intelligence (DSN) after the city was notified by the Austrian Computer Emergency Response Team (CERT) on September 9. Investigators suspect that a specialized scanning AI may have been used to identify the vulnerability for the data breach. A phishing attack is currently being ruled out. As of now, there are no indications that the stolen data has been published, and officials emphasized that attackers did not gain control over municipal IT systems or user accounts.