Municipality of Epe hacked via a single cracked password
The cyberattack on the municipality of Epe did not begin with a software vulnerability, but with a clever ClickFix social engineering attack in which an employee manually activated malware. The attacker subsequently managed to crack an administrator’s password, gaining access to a Kerberos admin ticket. Following this, an emergency account without MFA was also compromised—an account with virtually unlimited privileges within the environment.
With these privileges, approximately 871 GB of data (550,000 files) was copied to external cloud storage via AzCopy. The exfiltrated data included an export of the BRP (Personal Records Database), containing names, addresses, dates of birth, and BSN numbers of residents. Personal data of employees, financial information, applications for municipal services, and approximately 1,000 identity documents were also stolen.
The affected files were located on an old file server that was already scheduled to be phased out in favour of SharePoint and Teams.
To date, the data has not been published, no ransom has been demanded, and there are no indications of misuse of the stolen data.
The municipality concludes that human error and insufficiently secured emergency accounts were the primary success factors for the attacker. As a countermeasure, the awareness programme will be renewed, PowerShell and Run usage will be restricted, sensitive data storage will be reduced, and network segmentation will be tightened.
