Business continuity in the public sector: essential services need a Plan B

Cyberattacks and IT outages have become part of everyday life

In 2025, 1,041 ransomware attacks were reported in Germany, 10 % more than in the previous year. This is shown in the Federal Cybercrime Situation Report published by the Federal Criminal Police Office (Bundeskriminalamt, BKA). Businesses and public institutions are the main targets. The number of distributed denial-of-service (DDoS) attacks rose even more sharply, by 25 % – with government agencies and public administrations among the most frequent targets. The Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) reaches a similar conclusion in its report "IT Security in Germany 2025": public administration is currently the main target of cyber espionage in Germany.

After a cyberattack on the Eichstätt municipal administration came to light on 12 October 2026, large parts of the IT system had to be taken offline as a precautionary measure. As a result, many municipal services were unavailable via email for several days. In September 2026, blackmailers gained access to large quantities of data and documents via the Berlin administration’s data network, paralysing key public services for days. Similarly, in the summer of 2026, the Rhein-Nahe Association of Municipalities fell victim to a cyberattack and faced far-reaching restrictions, including in the areas of email communication, public services and financial administration.

A look at cases from further back illustrates the far-reaching consequences of such attacks and outages: following a cyberattack in July 2021, the district of Anhalt-Bitterfeld was forced to declare a state of emergency, which lasted seven months and caused damage amounting to approximately 2.5 million euros. In October 2023, 74 local authorities and around 1.7 million residents in North Rhine-Westphalia were affected following a ransomware attack on the local authority IT service provider Südwestfalen-IT.

Who is behind the attacks?

Cybercriminals seeking to make a profit

Criminal extortionist groups continue to account for the largest proportion of cyberattacks. They are after money: They use, amongst other things, ransomware, phishing and business email compromise, encrypt data and also threaten to publish the stolen information. Local authorities are often targeted at random, as perpetrators use automated tools to scan the internet for vulnerabilities. Nevertheless, public bodies remain a lucrative target: they manage sensitive registration, social security, health and pupil data, and are under considerable pressure to resume their services quickly.

Politically motivated cyber-attacks

State and state-affiliated actors take a different approach: they seek information and influence, and in extreme cases, opportunities for sabotage. According to BSI President Claudia Plattner, most attacks originate from Russia, China, Iran or North Korea. The main targets are ministries and government departments, the judiciary and security agencies. Energy and water suppliers face the additional risk of sabotage.

Hacktivist groups also pursue political goals: they aim to attract media attention and influence the political and social landscape. Very often, they use denial-of-service attacks to cripple the websites and online services of government bodies, local authorities and federal states. In 2025, the BKA recorded more than 700 announcements and reports of attacks against targets in Germany. According to the BKA, hacktivism is rising sharply: in 2025, the figure was 224 % higher than in the previous year.

The entire public sector is becoming a target

If a public institution fails, entire local authorities, districts or groups of people are affected. The situation is exacerbated by the fact that many institutions have to make do with tight budgets and limited IT staff, and share data centres. Furthermore, any outage is immediately visible to the public.

If servers and email accounts belonging to cities, towns or districts are encrypted in a ransomware attack, public services come to a standstill. A system failure at local authority IT service providers or in local authority data centres affects many member local authorities simultaneously. An espionage attack or data breach in state and federal authorities, the judiciary or the executive exposes or paralyses internal coordination, confidential documents, procedures and processes.

As the examples show, these attacks often affect critical operations and services provided by organisations, including hospitals and public health authorities, emergency services and fire brigades, as well as energy, water and waste management. Similarly, schools, universities and research institutions, local public transport and transport operators, as well as job centres, social security agencies and social services, are targets and victims of cybercriminals.

Different legal obligations for public bodies

The NIS-2 Directive and the corresponding German implementing legislation establish an important legal framework not only for businesses but also for public administration: for the federal government, the NIS-2 Implementation Act applies. The federal states are responsible for their own authorities. They are implementing NIS-2 at varying speeds, either by law or by administrative regulation.

Local authorities occupy a special position: Germany has not made use of the option to include them, and the existing state laws apply only to the state administration. There is hardly any federal state in which local authorities are required to report IT security incidents. Nor does the federal act cover schools and universities.

However, this does not mean that local authorities are exempt from NIS-2: local infrastructure such as municipal utilities, water suppliers, waste management companies, transport operators or local hospitals may well fall within the scope of the implementing legislation. The sector and size of the organisations are the decisive factors. In our blog on the German NIS-2 Implementation Act , you can find out more about it.

Operators of critical infrastructure, such as in the energy, water and healthcare sectors, have also been required to comply with the KRITIS umbrella law since 17 March 2026. It requires risk analyses, resilience plans and reports to be submitted within 24 hours. This means that local utility providers are affected in two ways.

Even though NIS-2 and the KRITIS Framework Act are not binding on the entire public sector, two principles apply:

• If personal data is compromised in an incident, the organisation must, as a rule, report this to the data protection supervisory authority within 72 hours in accordance with the GDPR.
• Even in the absence of legal obligations, there remains a social responsibility to provide essential public services.

Operational capability and business continuity are part of essential public services

Regardless of legal obligations, many contingency plans focus on backups and system recovery. However, it often takes weeks or months for systems and processes to be up and running again. During this time, the organisation must continue to operate, and to do so it needs one thing above all else: communication.

Crisis management teams must coordinate their efforts, staff need instructions, and citizens, parents, patients or the utility company’s customers expect information. And depending on the organisation, the BSI, supervisory authorities and data protection authorities expect reports within a timeframe of between 24 and 72 hours.

However, in most cases, e-mail, calendars, file storage and video conferencing rely on precisely the infrastructure that has just failed: When Clausthal-Zellerfeld Municipal Utilities were attacked in October 2025, their communication systems failed. During the attack on Südwestfalen-IT, dozens of local authorities simultaneously lost their usual channels – and with them the ability to coordinate with one another and with the service provider.

Staff and teams then often fall back on private messengers, private email addresses or printed telephone lists. This use of shadow IT is insecure, raises data protection concerns and makes it more difficult to document the incident later on. A good contingency plan therefore not only answers the question of how systems will be restored, but also how the organisation will operate and communicate in the meantime.

Six steps to ensuring operational capability in an emergency

1. Identify time-critical processes: Carry out a business impact analysis in accordance with BSI Standard 200-4. This will clarify which tasks can be interrupted and for how long.
2. Define the crisis management team, roles and reporting channels: Establish who makes decisions, who communicates and who reports to the authorities. Regardless of legal obligations, you should set out roles, stand-ins and deadlines in an emergency plan.
3. Plan communication channels independently of your primary system: Emergency channels must be independent and must not rely on infrastructure that could fail.
4. Prepare templates: Draft documents in advance, such as initial reports to the authorities, information for staff, press releases, letters to parents or information for the public, to save valuable time in an emergency.
5. Involve partners and the network: Local authority data centres, member municipalities, school authorities, network operators and similar organisations should know how to contact one another in an emergency. If a shared service provider fails, an independent channel is needed through which all those affected can coordinate.
6. Practise for emergencies regularly: Simulate a crisis scenario and assess whether your contingency plan works.

Attacks and outages in the public sector are now a structural and growing risk. Plan your emergency communications in advance to minimise downtime, thereby ensuring you remain operational and maintain public trust in your organisation.