On 15.01.2022 the homepage of the DARC became the target of a cyber attack. The attack exploited a security vulnerability in a plugin in a Wordpress installation. On 17.01.2022 the attack spread to the main pages of our association. The attack was detected on 17.01.2022 and then promptly stopped and repelled. At 22:00 on the same day, the homepage from Friday's backup could be put back online.

Our provider analyzed the traffic for the affected period and said that he could not detect any abnormalities, so a data leak can not be assumed.

We therefore assume that the – presumably automated – attack was only aimed at redirecting to Russian websites and not spying on member data. The member data is stored in folders separate from the website. Complete bank details or other sensitive information are not included in this data, as the bank details stored for the purposes of assignment are only stored in abbreviated form. The login passwords of the members are stored encrypted.

Despite the unlikely risk of data leakage, the Board of Directors would like to inform you of the process and will take further action to be on the safe side. In order to clarify the facts, the Executive Board has filed a criminal complaint against unknown persons. Likewise, the Hessian data protection officer was informed today as a precaution about the hacker attack. Furthermore, an IT company is commissioned with the forensic processing of the facts.

We also took immediate action to secure our systems. We will continue to implement measures in the coming days to further increase the security of our systems.

The Executive Board takes this attack very seriously and has stipulated that our system may not go fully online again until safe operation is guaranteed. In addition to various other topics, it is also about the security of passwords for the internal area of the members. To this end, the first measures have already been discussed, which will be communicated and implemented in the coming days.

We therefore ask our members for your understanding if the homepage with all its peripherals will not be available as usual in the next few days. The next few days and weeks will also bring various changes to ensure the security of the member data entrusted to us in the future.

In order to maintain communication during this time, we will use Facebook in addition to Twitter to inform you.

DARC - https://darc.de/