Cyber ​​attack on Ellwangen: Schools fight with IT failures!

Cyber ​​attack on Ellwangen: Schools fight with IT failures!

Ellwangen, Deutschland - On May 5, 2025, the city administration of Ellwangen was the goal of a cyber attack that had a significant impact on the IT systems and in particular on urban schools. After the first impressions that occurred on April 24, 2025, hackers could have entered the systems through one of the schools. The majority of the administrative IT now works again, but the schools are still faced with restrictions, especially when using a communication app for pupils and teachers.

Affected programs were switched off immediately after the attack to prevent further damage. One exception is only one school that uses other software. Teaching takes place in all schools, but teachers use private laptops at this one school, as the program for digital plates and projectors is disturbed. Despite the disorders, the city administration remains available by email and telephone, although there may be delays in the email system.

Current situation and crisis management

The crisis staff, consisting of internal and external IT specialists, was quickly set up to cope with the incident. The city administration already informed cyber insurance about the attack, but noticed any extortion claims. Forensic studies continue to run and have shown that attackers may have access to technical information on the network structure and configuration of the systems. So far, however, there is no evidence of access to personal data from citizens. The state representative for data protection and freedom of information was also notified.

The municipal IT department is working intensively on the review and restoration of around 200 servers. This is done with great care, but experts appreciate that the complete restoration of the systems will take a long time. The city administration of Ellwangen has guaranteed to inform the public about relevant developments promptly and to continue working with the security authorities and the Baden-Württemberg cyber security agency.

cyber attacks in general context

The incident in Ellwangen is involved in an increasing number of cyber attacks on municipalities in Germany. According to the current surveys of the BKA, more than two dozen attacks on municipal administrations and health facilities have been registered in the past two years, with ransomware often used as a blackmail method. For example, the Rhein-Pfalz-Kreis was affected by a serious data drainage, which had tragic consequences for the normal operation of the administration. Experts warn of the increasing professionalization of the perpetrators and demand measures to sensitize employees for IT security.

The city of Ellwangen remains optimistic that it can cope with the technical problems and that schools will soon be able to work with IT-supported applications again. Until then, such cyber attacks are a serious topic that presents every public institution for new challenges.

For more information about the incident in Ellwangen, please visit the articles from Schwäbische Post , Tagesschau and Tagesschau .