Reported Cyberattack Disrupts Administration at Berlin Heat Plant; Heating Unaffected
Summary
A reported March 20 cyberattack on Berlin’s Fernheizwerk Neukölln disrupted accounting and internal communications. Police confirmed the attack was known to them; the plant’s technical systems and heat supply were unaffected.
Key points
- The attack on Fernheizwerk Neukölln reportedly took place on March 20; Berlin police confirmed the incident had been known since that date.
- The report says the attackers demanded a ransom and threatened to publish stolen data after a March 29 deadline.
- Accounting was disrupted and internal communications experienced significant outages, according to the report.
- The plant’s technical systems and heating output were not affected.
- The Welt report attributes the attack to DragonForce; that attribution is not independently confirmed in the article.
- Phishing is considered a likely access method, with an employee possibly opening an email attachment, but this is presented as speculation.
Article Details
- Victim Organization
- Fernheizwerk Neukölln
- Incident Type
- Cyberattack against the administrative systems; a phishing attack was considered likely, and a ransomware-related extortion demand was reported.
- Incident Date
- 2026-03-20
- Disclosure Date
- 2026-03-31
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- The administrative level was reportedly affected, including disruption to accounting and significant outages in internal communications. The technical systems and heating output were not affected, according to Berlin police.
- Ransom Or Extortion
- Welt reported that the attackers demanded ransom for the release of data, set a deadline of 2026-03-29, and threatened to publish allegedly stolen data on the darknet. The operator reportedly let the deadline pass; the article does not confirm that data was stolen or published.
- Claim Status
- confirmed