Breaches and incidents
Kasseler Verkehrs- und Versorgungs-GmbH (KVV): malicious code injected into group websites prompted visitors to install software
Per hessenschau (24 Sep), KVV said unknown parties embedded malicious code in several of its websites, including kvvks.de, kvg.de, netzplusservice.de and...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per hessenschau (24 Sep), KVV said unknown parties embedded malicious code in several of its websites, including kvvks.de, kvg.de, netzplusservice.de and the public pools’ sites; some visitors were prompted to install something or change settings, and anyone who complied may have loaded malware.
- Root cause: not established; KVV has external forensics investigating how the sites were manipulated.
- No attacker named.
- The code was removed; KVV says its core IT systems were not affected and there is no evidence customer data was affected; police, the BSI and Hesse’s data protection authority were informed, and the BSI advised affected users to change passwords.