Ransomware attack on Austria's Korneuburg municipality postponed funerals

The municipal administration of Korneuburg, a town of about 13,000 people on the Danube north of Vienna, was hit by ransomware overnight between February 5 and 6, 2024. Staff found they could no longer reach the town's data, and the entire municipal network was shut down as a precaution.

The outage was close to total. Deputy mayor Helene Fuchs-Moser, deputizing for a mayor who was on holiday, said everything was dead and that officials could not even print out registration forms, death certificates or transfer bills. Because Austrian funeral directors require a death certificate before a burial or cremation, local funerals were postponed. Residents could reach the town hall only by telephone.

Korneuburg filed a police report, and the investigation was handled by Austria's state protection service, the Lower Austrian state criminal police and the federal criminal police. National bodies including the interior and defence ministries and the chancellery were drawn in. Officials confirmed receiving an extortion demand but did not disclose the amount, and said they had decided against paying. The town noted that its IT had been security-certified two months earlier, in December 2023.

The municipality restored secured normal operations on February 23, 2024, rebuilding from a backup dated January 27 and re-entering the intervening records. It put the direct damage at roughly 100,000 euros, plus substantial staff time, and said authorities had established that no data was exfiltrated.