Cyberattack halts GSW direct debit collections
The cyberattack on Gemeinschaftsstadtwerke Kamen, Bönen, Bergkamen became known on the evening of 28 June 2026. Because the company took its IT systems offline as a precaution, customer instalments due on 1 July could not be collected by direct debit as usual, according to ZfK. GSW later revised its assessment of affected customer data.
Key takeaways
- Supply remained unaffected, according to the company. ZfK reported that customer instalments due on 1 July could nevertheless not be collected by direct debit. Instalments owed to EEG customers were outstanding in early July.
- Care took priority over speed during recovery. Applications were brought back online gradually only after all systems, servers and user accounts had been checked. Finer network segmentation was also introduced.
- The initial assessment of customer data did not hold. New investigative findings suggest that backups from 2019 and partly from 2017 may be affected. GSW says customer data from the attack was briefly available on the darknet.
Related: Black October: Many attacks had been under way for months
The situation at GSW
Managing director Alexander Loipfinger heads GSW Gemeinschaftsstadtwerke Kamen, Bönen, Bergkamen. The utility’s business has a technical and a commercial side. The technical side is supply itself. The commercial side includes digital customer channels, from the online customer centre to the “Meine GSW” app, as well as payments.
Payments flow in both directions. The utility collects customer instalments, advance payments against later bills. It also pays instalments to EEG customers who feed electricity into the grid and receive compensation under Germany’s Renewable Energy Sources Act. According to the company, the cyberattack never affected security of supply. The case shows, however, that secure supply does not rule out severe disruption to a utility’s payment processes.
What is network segmentation? Network segmentation divides a corporate network into separate areas between which traffic flows only according to defined rules. An attacker who breaches one area cannot easily reach other systems. GSW introduced finer segmentation as an additional security measure during recovery.
Timeline of the attack
On the evening of 28 June 2026, the cyberattack on GSW became known. The company immediately convened its crisis team, took its IT systems offline as a precaution and informed the state criminal police office and the relevant authorities.
Customers felt the effects of the disconnection a few days later. According to ZfK, regular customer instalments due on 1 July 2026 could not be collected by direct debit as usual because internal systems and applications had been disconnected as a precaution. ZfK also reported that instalments owed to EEG customers remained outstanding as of 2 July.
Over the following weeks, GSW gradually restored its systems. The online customer centre and other digital customer channels were accessible again on 16 July.
Decisions by the crisis team
Taking systems offline as a precaution immediately after the attack became known was the first major decision. The next task was recovery. According to managing director Alexander Loipfinger, GSW prioritised care over speed during recovery.
Working with IT security experts and investigating authorities, the company first checked all systems, servers and user accounts. Only then did GSW gradually bring systems and applications back online. As an additional security measure, it introduced finer network segmentation, dividing the network into more isolated areas. Recovery therefore also involved redesigning the network architecture.
Results of recovery and forensics
Payment processes resumed in August. GSW was able to collect customer instalments due on 1 August 2026, a company spokesperson told Energie & Management. From 6 August, payment systems at GSW swimming pools also accepted cashless payments again, according to Antenne Unna.
GSW had to revise its assessment of customer data. Previous forensic investigations, which examined technical traces on the systems, had found no affected customer data. New investigative findings suggest, however, that older backups from 2019 and partly from 2017 may be affected. According to the company, customer data from the attack was available for a short time on the darknet, a part of the internet accessible only through anonymisation services.
In the same statement, GSW said there was no evidence at that time that the affected customer data had been published, shared or misused. Customers received specific guidance on account activity, contacting their bank, suspicious requests and passwords.
Lessons for CISOs in the DACH region
The GSW case offers several lessons for security leaders.
- Utilities’ emergency plans need dedicated scenarios for payment processes. Secure supply does not rule out severe disruption to direct debit collections, outgoing payments and point-of-sale systems.
- Disconnecting networks should be a prepared option in the crisis plan, along with an overview of the business processes that depend on the disconnected systems. At GSW, taking internal systems and applications offline directly affected direct debit collections.
- A phased recovery requires a defined order of checks. GSW checked systems, servers and user accounts before bringing them back online. It also used the restart to introduce finer segmentation.
- Backups should be fully included in the data inventory, including retention periods and a deletion plan. At GSW, new investigative findings identified backups from 2019 and partly from 2017 as potentially affected.
- Initial statements about data leaks should be marked as provisional. GSW later had to revise the findings of its previous forensic investigations and accompanied the correction with guidance for its customers.
Frequently asked questions
Each question is closed. Tap to reveal the answer.
What does GSW advise customers to do after the data incident?
GSW recommended checking account activity regularly and contacting their bank if anything unusual appears. Customers should not disclose sensitive information in response to incoming messages or calls. GSW also advised against reusing passwords.
Which GSW online services were accessible again on 16 July?
By then, the online customer centre, the self-service functions of the “Meine GSW” app and the network portal for grid connection applications were accessible again. Like all systems, these services were brought back online gradually only after all systems, servers and user accounts had been checked.
What changed at GSW swimming pools on 6 August?
According to Antenne Unna, the pools’ payment systems accepted cashless payments again from that day. Vouchers could also be purchased and redeemed again.
Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
