GUTcert Confirms Data Theft After Cyberattack, With Possible KRITIS Exposure Under Investigation
Summary
GUTcert says attackers accessed parts of its IT systems and stole about 640 GB of data, including customer audit and technical information. Forensic work continues; the article raises concerns that some data may relate to critical infrastructure.
Key points
- GUTcert said unauthorized access began on September 5, 2026, and about 640 GB of data was stolen between September 6 and 9.
- Reportedly affected information includes customer contact details, audit records, management-system documentation, technical information and vulnerability details; some possible data categories remain under review.
- A reader said the stolen material may include sensitive information about energy and other critical-infrastructure operators. The article presents this as a concern, not a confirmed finding about the stolen dataset.
- GUTcert reported disabling compromised accounts, replacing VPN certificates and credentials, resetting its KRBTGT account, and decommissioning the initially attacked system, among other measures.
- The company said it notified customers and auditors, reported the incident to Berlin's data-protection authority and the LKA, and voluntarily informed the BSI. Forensic examination is ongoing.
- GUTcert said attackers contacted customers and auditors by email on September 20 with download links to stolen data; it asked recipients to forward and delete the messages. The article's readers raised concerns about preserving evidence and possible phishing.
Article Details
- Victim Organization
- GUTcert (GUT Certifizierungsgesellschaft für Managementsysteme mbH)
- Incident Type
- Unauthorized access to parts of GUTcert's IT systems, theft of data, and subsequent extortion attempts
- Incident Date
- 2026-09-05
- Disclosure Date
- 2026-09-14
- Data Types Exposed
- Employee personal data
- GUTcert financial and tax data
- Customer contact details
- Audit evidence and reports
- Management-system and procedural documentation
- Technical information and vulnerability details
- Other customer information
- Potentially employee data and credentials, certificates, or other confidential information; still under investigation
- Affected Data Size
- Approximately 640 GB of data reportedly stolen between 2026-09-06 and 2026-09-09, according to GUTcert as reported in the article.
- Operational Impact
- Attackers gained unauthorized access to parts of GUTcert's IT systems. Identified attacker access was interrupted on 2026-09-10; a still-active email session was found and terminated on 2026-09-15. Forensic investigation of possible further activity was ongoing. The article reports no indication of unauthorized access to the Nextcloud platform or its stored data.
- Ransom Or Extortion
- GUTcert reported an extortion attempt on 2026-09-12 and a further extortion email on 2026-09-15; it did not respond and said it would not comply. On 2026-09-20, customers, auditors, and employees reportedly received emails from the extortionists containing download links to data described as stolen from GUTcert.
- Claim Status
- confirmed