A cyberattack began overnight on 1 September 2026 at Stadtwerke Landsberg, a municipal utility in Upper Bavaria. The utility told customers on 8 September that attackers had encrypted its central IT network. The Record reported the notice on the same day, and T&D World followed on 9 September.
What happened
- Overnight on 1 September: the incident began. A secondary tracker lists 30 August, so the exact start is not settled.
- The utility disconnected affected systems from the internet, activated its crisis team and brought in outside cybersecurity specialists.
- Office systems and central IT were encrypted. Email and some landline telephones were affected.
- By about 7 September customer inquiries and contract processing had resumed, with phone and email still limited.
What is confirmed, reported and unknown
- Confirmed by the utility, as reported: the encryption of central IT, the disruption of office systems, and the statement that electricity, water and other essential services were not affected.
- Reported: T&D World reports the website stayed up and that the utility isolated internal networks and cut broader internet connections as a precaution.
- Unknown: who attacked, whether an extortion demand was made, how the attackers got in, and whether data was stolen. The utility said it "could not rule out" that attackers accessed or stole personal data such as names, addresses, phone numbers, email addresses and bank details. The Record says there was no indication of a link to any other incident.
The word encrypted is the utility's own. Calling the event ransomware is an inference, so we label it as one.
What to do now
- Ask whether a total loss of corporate IT would stop your operational technology. Answer from evidence, not from the network diagram.
- Check that your control systems have no accounts, shares or remote tools in common with office IT.
- Keep an out of band contact list: printed phone numbers, a second email domain, a messaging app not tied to your directory.
- Prepare a customer notice for the case where you cannot rule out data theft, as this utility had to.
- Test restoring your identity system, because everything else waits for it.
How this could have been avoided
The entry point is not public, so these controls address the outcome that is known.
- A hard boundary between IT and OT. The utility says essential services kept running. T&D World notes that depends on separation of corporate and operational systems. Make that separation a tested control.
- A rehearsed isolation step. Disconnecting quickly limited the spread. Write the steps and practice them.
- Offline backups and a restore order. Customer processing took about a week to resume.
- Reduce what a stolen copy contains. Data you do not keep cannot be named in a notice.
Try it yourself
List your ten most important systems. Next to each, write whether it needs corporate IT, the internet or the directory to work.
Click through it at your own pace, or open it full screen.
Quick check
Did the attack affect the power grid?
The utility said electricity, water and other essential services were not affected. The attack hit office systems and central IT.
Was customer data stolen?
Unconfirmed. The utility could not rule it out and said forensic work was ongoing.
