Carinthia ransomware paralyzes state administration and public services

On May 24, 2022, the Austrian state of Carinthia detected ransomware that encrypted administrative workstations and servers, causing a widespread shutdown of government IT, official communications and online public services. Austria's Court of Audit later established that attackers initially accessed the environment on April 21 and stole government data. The state did not pay the five-million-euro ransom demand; that demand is not recorded as a financial loss. Contemporary local reporting identified BlackCat as the suspected operator, without conclusive attribution in the later national audit.