Cyberattack Encrypts Most of Hrastnik Municipality’s Data, Causing €70,000 in Recovery Costs

Summary

Hrastnik Municipality says attackers used a remote-access test account to enter its systems and encrypt most data, disrupting services. It estimates recovery costs at €70,000 and says its analysis found no evidence of data theft.

Key points

• The municipality said it discovered the intrusion on March 23, 2026, and that it had occurred about a week earlier through a test account for remote access.
• Attackers encrypted most of the municipality’s data, disrupting administration and temporarily blocking access to the municipal budget and accounting work.
• The municipality said technical analysis indicated with high confidence that data was not transferred or misused; its document archive and employee email were not affected.
• The municipality estimated the damage at about €70,000, including new equipment, system restoration, antivirus software, IT support and staff time.
• It restored the data it needed and introduced a new server and storage system, improved backups, updated security policies and restricted remote access.
• The municipality reported the incident to police, Slovenia’s Information Commissioner and SI-CERT. It said an organized criminal group may have been responsible; an unconfirmed report said the attackers offered compensation for returning data.

MITRE ATT&CK

People