{"id":25589,"date":"2026-10-31T08:00:00","date_gmt":"2026-10-31T08:00:00","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=25589"},"modified":"2026-11-03T10:45:44","modified_gmt":"2026-11-03T10:45:44","slug":"cyberattack-halts-gsw-direct-debit-collections","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/31\/cyberattack-halts-gsw-direct-debit-collections\/","title":{"rendered":"Cyberattack halts GSW direct debit collections"},"content":{"rendered":"<p><strong>The cyberattack on Gemeinschaftsstadtwerke Kamen, B\u00f6nen, Bergkamen became known on the evening of 28 June 2026. Because the company took its IT systems offline as a precaution, customer instalments due on 1 July could not be collected by direct debit as usual, according to ZfK. GSW later revised its assessment of affected customer&nbsp;data.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Supply remained unaffected, according to the company.<\/strong> ZfK reported that customer instalments due on 1 July could nevertheless not be collected by direct debit. Instalments owed to EEG customers were outstanding in early&nbsp;July.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Care took priority over speed during recovery.<\/strong> Applications were brought back online gradually only after all systems, servers and user accounts had been checked. Finer network segmentation was also&nbsp;introduced.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">The initial assessment of customer data did not hold.<\/strong> New investigative findings suggest that backups from 2019 and partly from 2017 may be affected. GSW says customer data from the attack was briefly available on the&nbsp;darknet.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/22\/black-october-many-attacks-had-been-running-for-months\/\" target=\"_blank\" rel=\"noopener\">Black October: Many attacks had been under way for&nbsp;months<\/a><\/p>\n<h2>The situation at&nbsp;GSW<\/h2>\n<p>Managing director Alexander Loipfinger heads GSW Gemeinschaftsstadtwerke Kamen, B\u00f6nen, Bergkamen. The utility&#8217;s business has a technical and a commercial side. The technical side is supply itself. The commercial side includes digital customer channels, from the online customer centre to the \u201cMeine GSW\u201d app, as well as&nbsp;payments.<\/p>\n<p>Payments flow in both directions. The utility collects customer instalments, advance payments against later bills. It also pays instalments to EEG customers who feed electricity into the grid and receive compensation under Germany&#8217;s Renewable Energy Sources Act. According to the company, the cyberattack never affected security of supply. The case shows, however, that secure supply does not rule out severe disruption to a utility&#8217;s payment&nbsp;processes.<\/p>\n<div data-element=\"definition_box\" style=\"background:#23261f;border:1px solid rgba(105,216,237,0.22);border-radius:10px;padding:20px 24px;margin:32px 0;box-shadow:0 2px 10px rgba(0,0,0,0.22);\">\n<p style=\"margin:0;color:#e6e3da;line-height:1.6;\"><strong>What is network segmentation?<\/strong> Network segmentation divides a corporate network into separate areas between which traffic flows only according to defined rules. An attacker who breaches one area cannot easily reach other systems. GSW introduced finer segmentation as an additional security measure during&nbsp;recovery.<\/p>\n<\/div>\n<h2>Timeline of the&nbsp;attack<\/h2>\n<p><a href=\"https:\/\/gsw-kamen.de\/nachrichten\/cyberangriff-bei-den-gsw---alle-hellip:259057\" target=\"_blank\" rel=\"noopener\">On the evening of 28 June 2026<\/a>, the cyberattack on GSW became known. The company immediately convened its crisis team, took its IT systems offline as a precaution and informed the state criminal police office and the relevant&nbsp;authorities.<\/p>\n<p>Customers felt the effects of the disconnection a few days later. According to ZfK, regular customer instalments due <a href=\"https:\/\/www.zfk.de\/unternehmen\/nachrichten\/gsw-nehmen-nach-cyberangriff-interne-systeme-offline\" target=\"_blank\" rel=\"noopener\">on 1 July 2026<\/a> could not be collected by direct debit as usual because internal systems and applications had been disconnected as a precaution. ZfK also reported that instalments owed to EEG customers remained outstanding as of 2&nbsp;July.<\/p>\n<p>Over the following weeks, GSW gradually restored its systems. The online customer centre and other digital customer channels were accessible again on 16&nbsp;July.<\/p>\n<h2>Decisions by the crisis&nbsp;team<\/h2>\n<p>Taking systems offline as a precaution immediately after the attack became known was the first major decision. The next task was recovery. According to managing director Alexander Loipfinger, GSW prioritised care over speed during&nbsp;recovery.<\/p>\n<p>Working with IT security experts and investigating authorities, the company first checked all systems, servers and user accounts. Only then did GSW gradually bring systems and applications back online. As an additional security measure, it introduced finer network segmentation, dividing the network into more isolated areas. Recovery therefore also involved redesigning the network&nbsp;architecture.<\/p>\n<h2>Results of recovery and&nbsp;forensics<\/h2>\n<p>Payment processes resumed in August. GSW was able to collect customer instalments due <a href=\"https:\/\/www.energie-und-management.de\/nachrichten\/detail\/\/im-august-kehrt-bei-attackiertem-stadtwerk-die-normalitaet-ein-373667\" target=\"_blank\" rel=\"noopener\">on 1 August 2026<\/a>, a company spokesperson told Energie &amp; Management. From <a href=\"https:\/\/www.antenneunna.de\/artikel\/nach-cyberangriff-bargeldlose-zahlung-bei-gsw-wieder-moeglich-2722372\" target=\"_blank\" rel=\"noopener\">6 August<\/a>, payment systems at GSW swimming pools also accepted cashless payments again, according to Antenne&nbsp;Unna.<\/p>\n<p>GSW had to revise its assessment of customer data. Previous forensic investigations, which examined technical traces on the systems, had found no affected customer data. New investigative findings suggest, however, that older backups from <a href=\"https:\/\/gsw-kamen.de\/nachrichten\/neue-erkenntnisse-nach-dem-cyberangriff:259473\" target=\"_blank\" rel=\"noopener\">2019<\/a> and partly from 2017 may be affected. According to the company, customer data from the attack was available for a short time on the darknet, a part of the internet accessible only through anonymisation&nbsp;services.<\/p>\n<p>In the same statement, GSW said there was no evidence at that time that the affected customer data had been published, shared or misused. Customers received specific guidance on account activity, contacting their bank, suspicious requests and&nbsp;passwords.<\/p>\n<h2>Lessons for CISOs in the DACH&nbsp;region<\/h2>\n<p>The GSW case offers several lessons for security&nbsp;leaders.<\/p>\n<ol>\n<li>Utilities&#8217; emergency plans need dedicated scenarios for payment processes. Secure supply does not rule out severe disruption to direct debit collections, outgoing payments and point-of-sale&nbsp;systems.<\/li>\n<li>Disconnecting networks should be a prepared option in the crisis plan, along with an overview of the business processes that depend on the disconnected systems. At GSW, taking internal systems and applications offline directly affected direct debit&nbsp;collections.<\/li>\n<li>A phased recovery requires a defined order of checks. GSW checked systems, servers and user accounts before bringing them back online. It also used the restart to introduce finer&nbsp;segmentation.<\/li>\n<li>Backups should be fully included in the data inventory, including retention periods and a deletion plan. At GSW, new investigative findings identified backups from 2019 and partly from 2017 as potentially&nbsp;affected.<\/li>\n<li>Initial statements about data leaks should be marked as provisional. GSW later had to revise the findings of its previous forensic investigations and accompanied the correction with guidance for its&nbsp;customers.<\/li>\n<\/ol>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Each question is closed. Tap to reveal the&nbsp;answer.<\/p>\n<details>\n<summary><strong>What does GSW advise customers to do after the data&nbsp;incident?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">GSW recommended checking account activity regularly and contacting their bank if anything unusual appears. Customers should not disclose sensitive information in response to incoming messages or calls. GSW also advised against reusing&nbsp;passwords.<\/p>\n<\/details>\n<details>\n<summary><strong>Which GSW online services were accessible again on 16&nbsp;July?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">By then, the online customer centre, the self-service functions of the \u201cMeine GSW\u201d app and the network portal for grid connection applications were accessible again. Like all systems, these services were brought back online gradually only after all systems, servers and user accounts had been&nbsp;checked.<\/p>\n<\/details>\n<details>\n<summary><strong>What changed at GSW swimming pools on 6&nbsp;August?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">According to Antenne Unna, the pools&#8217; payment systems accepted cashless payments again from that day. Vouchers could also be purchased and redeemed&nbsp;again.<\/p>\n<\/details>\n<p><!--ST-LOWER-CARDS lang=en--><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (November 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"GSW says its supply remained unaffected. Payment processes were nevertheless severely restricted.","protected":false},"author":50,"featured_media":25560,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Gemeinschaftsstadtwerke Kamen","_yoast_wpseo_title":"GSW cyberattack halts direct debit payments","_yoast_wpseo_metadesc":"After a cyberattack, GSW says its supply remained unaffected. Payment processes, including direct debit collections, were severely restricted.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/cover-hero-22.jpg","_yoast_wpseo_opengraph-image-id":25560,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/11\/cover-hero-22.jpg","_yoast_wpseo_twitter-image-id":25560,"evm_kih_original":false,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[215],"tags":[],"class_list":["post-25589","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies"],"evm_reading_time_minutes":6,"wpml_language":"en","wpml_translation_of":25543,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=25589"}],"version-history":[{"count":10,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25589\/revisions"}],"predecessor-version":[{"id":26026,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25589\/revisions\/26026"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/25560"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=25589"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=25589"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=25589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}