The German municipality of Tangerhütte was targeted in a cyberattack that its software provider believes was conducted with artificial intelligence.
If the assessment is confirmed, the incident could represent the first publicly reported AI-driven cyberattack against a municipality in Germany.
Tangerhütte is located in Saxony-Anhalt and operates a digital town hall through which residents can access services such as registering a residence, applying for childcare, registering a business and arranging appointments.
Attackers Exploited an Unknown Vulnerability
The attackers exploited a previously unknown vulnerability in software developed by Innocon, according to an MDR investigation.
Innocon CEO Hagen Woecht described the issue as a zero-day vulnerability because it was not known to the company or its software testers and no security update was available when it was exploited.
The attack began during the night. A municipal IT employee discovered irregularities the following morning, isolated the affected server and disconnected it from the internet.
This response made Tangerhütte’s digital town hall unavailable, while the municipality’s wider administrative operations continued through telephone, email, postal and in-person services.
Provider Points to Evidence of AI Involvement
Woecht said the company classified the incident as an AI-driven attack after examining server logs on an isolated computer.
One indicator was the speed at which commands were executed. Woecht said the activity occurred too quickly to have been performed manually, even by an attacker copying and pasting prepared commands.
The company also found that the attack code appeared to be developed and modified during the intrusion. According to Woecht, this suggested the operation was adapting to the target environment rather than simply running a previously prepared script.
Cybersecurity researchers interviewed by MDR said the explanation was plausible. However, they had not independently examined the relevant logs, meaning the involvement of AI has not been conclusively established.
The Saxony-Anhalt State Criminal Police Office said it could neither confirm nor deny that AI was used because its investigation remains ongoing.
Other Municipalities Took Systems Offline
Innocon notified other customers after identifying the incident. Four additional municipalities reportedly took their digital town halls offline as a precaution.
The provider said it found no indications that those municipalities had also been attacked.
According to Innocon, the Tangerhütte attackers accessed only test accounts and did not obtain real citizen data. Police are nevertheless investigating the incident as suspected data spying.
Tangerhütte’s initial security notice said existing protection mechanisms had responded successfully and that the digital town hall was disabled as a precaution.
BSI Warns AI Can Accelerate Cyberattacks
Germany’s Federal Office for Information Security has warned that AI can allow attackers to identify and exploit vulnerabilities more quickly and across a much larger number of systems.
BSI Vice President Thomas Caspers told MDR that AI-assisted operations could potentially target hundreds or thousands of systems simultaneously. He also warned that AI tools may enable attackers with limited technical expertise to carry out more sophisticated operations.
The Tangerhütte incident may be the first known case of its kind involving a German municipality, but that characterization currently rests on the software provider’s analysis and has not been independently confirmed.
