News

What happened?

The Brandenburg Memorials Foundation has fallen victim to a so-called ransomware attack. The attackers gained access to the internal IT systems and encrypted parts of the IT systems and data using specialised software. The incident was detected on 5 August 2026. Both the memorial sites at all seven locations and the head office have been affected.

Visits to the memorial sites remain possible without restriction.

As the telephone lines and known email addresses are currently out of service, we ask that you use the following central email address to contact us until further notice: infoatemp.stiftung-bgode

Further information on the cyber attack

How was the attack addressed?

Immediately after the attack was detected, the following emergency measures were taken:

• We took the affected systems offline, i.e. disconnected all internet and network connections.
• We engaged an external IT security service provider recommended by the Federal Office for Information Security (BSI), who is assisting us in managing the situation and investigating the incident through a forensic analysis of our IT systems.
• We submitted a report to the relevant data protection authority in the State of Brandenburg within the prescribed timeframe.
• We have filed a report and contacted the Central Cybercrime Co-ordination Unit (ZAC) of the Brandenburg State Criminal Police Office, and are in contact with the relevant officers.

What happens next?

Our IT systems are being completely rebuilt and reinstalled by our IT department. This will ensure that attackers cannot gain access to the IT infrastructure again. Furthermore, a digital forensic investigation is being carried out by the IT security service provider we have engaged to determine which IT systems have actually been affected and whether any data may have been compromised.

It is expected to take a few more days until the systems have been re-set up. We ask for your understanding that, when re-installing the IT environment, security takes precedence over speed. Until the systems are available again, we will endeavour to maintain operations using alternative processes.

Were the systems not adequately protected?

All our IT systems are protected by various security measures. Unfortunately, despite all these security measures, it is never possible to achieve 100 per cent protection against such attacks. Nevertheless, we are using this incident as an opportunity to continuously enhance our existing security measures. In doing so, we will also take into account the results of the forensic investigation, which aims, amongst other things, to identify the point of entry used by the attackers.

Is the Brandenburg Memorials Foundation being blackmailed?

As is typical of ransomware attacks, the attackers gained unauthorised access to the Foundation’s IT infrastructure and subsequently encrypted parts of its IT systems and data using specialised software. As is also typical of such attacks, a text file was left behind demanding that contact be made with the attackers. If contact is made with the attackers, they usually demand payment in a cryptocurrency in exchange for decrypting the IT systems and data.

Was any data compromised during the attack?

We are currently conducting a forensic investigation to determine whether any data was compromised during the attack. However, given the attackers’ usual modus operandi in such cyber-attacks, we must assume that data was downloaded by the attackers.

What sort of data might have been compromised?

As things stand, the following data in particular may have been affected by the incident:

• internal administrative data
• company and contact details of our business partners and visitors
• agreements and documents relating to our collaboration with business partners.

What does this cyberattack mean for me as a visitor?

Until the systems are back online, there may be delays in processing enquiries, as the necessary data and systems are currently unavailable. In particular, we are currently unable to process bookings for educational programmes as usual. We therefore ask for your understanding. However, we are working flat out and prioritising the prompt restoration of our IT systems to ensure we can resume normal operations.

What should guests, cooperation partners and business partners of the Foundation be aware of at this time?

At present, it is not yet possible to say whether any data was downloaded by the attackers during the attack. Checking for data breaches is part of the forensic investigation being carried out by the IT security service provider we have engaged. If data is extracted by the attackers, it is often used to carry out follow-up attacks against visitors and partners of the affected organisations. We therefore ask you to observe the following advice:

• Following such attacks, there may be an increase in so-called phishing or spam emails. We therefore ask you to be extra vigilant when dealing with suspicious emails, particularly those that claim to be from the Foundation.
  • Be particularly vigilant if you are asked to carry out unusual actions, such as opening links.
  • Carefully check the sender and the content of messages, even if they appear trustworthy at first glance.
• If the attackers have downloaded data, they could also use it for so-called invoice fraud. You should therefore also be vigilant if you are asked to make a bank transfer to altered account details, even if legitimate invoices are being sent or the message refers to previous correspondence
• Do not disclose any confidential information unless you are certain that the contact is from a genuine and known individual.
• Should you notice any signs of misuse of the data in question, please notify us immediately at infoatemp.stiftung-bgode.