GUTcert critical infrastructure data breach

A breach at certifier GUTcert exposed German critical infrastructure data; energy utility ENTEGA confirms it is a downstream victim.

A GUTcert critical infrastructure data breach has exposed roughly 640 GB of documentation submitted by German energy-grid operators as certification evidence, including exact substation locations and network topology maps. On September 24, Darmstadt utility ENTEGA AG confirmed it is a downstream victim, and more operators are expected to come forward. What Happened GUTcert is a…

Read More

TerminalFix ClickFix Attack Campaign Hits Germany

A TerminalFix ClickFix attack campaign compromised a German state institution, BSI confirms — heise links it to Berlin's Rhysida actor cluster.

A TerminalFix ClickFix attack campaign has compromised a German state institution’s network, Germany’s Federal Office for Information Security (BSI) confirmed on September 4. TerminalFix is an evolution of the ClickFix social-engineering technique: a fake CAPTCHA tricks a user into pasting a command, but instead of the old single-machine Run-dialog trick, it opens Windows Terminal and…

Read More

Berlin Ransomware Attack: State Refuses to Pay

Berlin ransomware attack 2026 — Rhysida extortion of German state government network

A Berlin ransomware attack has put Germany’s capital in the position every public-sector CISO dreads: a confirmed data breach, a seven-figure ransom demand, and an election three weeks away. The ransomware group Rhysida claims it stole 5.79 terabytes from Berlin’s state administrative network and is demanding 30 Bitcoin, roughly €2.05 million, with a seven-day auction…

Read More

VMware vCenter CVE-2026-59310: Germany Hit Hardest

VMware vCenter CVE-2026-59310, a CVSS 9.8 flaw, is under active exploitation in 47 countries — Germany is hit hardest. What to do now.

VMware vCenter CVE-2026-59310, a maximum-severity path-traversal vulnerability scoring 9.8 on CVSS, is being actively exploited across 47 countries — and Germany is the single most-affected country of all of them. German incident-response firm QUIRSO uncovered the campaign live during an IR engagement, tracing 361 distinct victim IP addresses back to a directory-traversal flaw in vCenter’s…

Read More