Vienna Data Leak: Does NIS2 Apply to German Municipalities?

Written by the NIS2Compass editorial team · Updated: October 2026 (news coverage as of 11 October 2026)

From 3 to 11 September 2026, attackers copied around 26,000 documents from an internal platform of the City of Vienna, affecting 5,824 people. In Germany, a municipality's core administration would not fall under the BSIG. In NIS2Compass's assessment, though, municipal enterprises such as municipal utilities (Stadtwerke) and a city's IT service providers can.

What Happened at the City of Vienna?

On 9 September 2026, CERT.at told the City of Vienna that a vulnerability in one of its systems was for sale on an online forum. Via web access, an attacker had reached parts of an internal documentation platform of the city administration from 3 to 11 September. WienCERT and Wien Digital found and closed the gap with the Directorate State Protection and Intelligence Service (DSN) (City of Vienna press release).

Some 26,000 documents and pages were copied (about 9 GB), mostly test data, training materials and project documentation. They include technical documentation, business and infrastructure information and personal data, in places possibly GDPR special categories. Those affected are 2,885 citizens, 2,083 employees and 856 contractors. According to ORF Vienna, it is mostly names or email addresses, occasionally perhaps sick-leave days or IBANs.

CIO Klemens Himpele said: "At no time did the attacker have control over IT systems or user accounts of the City of Vienna." The city sees no signs of publication, and none had been reported by 11 October.

On 10 September, the city voluntarily reported the incident under the Austrian NIS Act, followed on 15 September by a notification to the Austrian Data Protection Authority. The vulnerability was up for sale before the city knew about it.

Does NIS2 Apply to Municipalities in Germany?

For core administration, generally not. The BSI makes this clear: "Core municipal administration generally does not fall within the scope of the BSIG." In Resolution 2023/39, the IT Planning Council chose not to use the NIS2 Directive's option for local administration; each German state decides for itself whether to include its municipalities.

Which Municipal Units Can Still Be Affected?

According to the BSI, organisational units without separate legal personality, often run as municipal enterprises (Regie- or Eigenbetriebe), can fall under the BSIG if they offer goods or services for a fee and fit an entity type in Annex 1 or 2 of the BSIG. The BSI cites fee-based waste disposal as an example.

For the thresholds, only the specific unit's figures count, not the whole administration's. Legally independent subsidiaries of such enterprises are assessed separately. Obvious candidates are energy and water supply, often run by municipal utilities.

What Applies to the Federal Administration?

Under § 29(2) BSIG, federal authorities are subject to the rules for particularly important entities. Exceptions include §§ 38 and 65, including the fine provision.

To see whether your company falls under the BSIG, use the NIS2Compass applicability check.

What Does the Case Mean for Service Providers to Municipalities?

According to the City of Vienna, 856 of the 5,824 affected people are contractors. Supply chain security therefore cuts both ways. Normally the customer vets its suppliers; in Vienna, the providers' data sat with the customer, and the customer's gap hit them too.

If an IT service provider is itself subject to NIS2, § 30(2) no. 4 BSIG requires measures for "supply chain security, including security-related aspects of the relationships with direct suppliers or service providers" (translated). The provision targets your own suppliers, but you should still know which of your employees' data sits in your clients' portals and project files. The industry page for IT service providers summarises the obligations.

For the reverse case, see who reports when something happens at a service provider.

Which § 30 BSIG Measures Address an Incident Like This?

An incident like Vienna's mainly touches three areas of obligation under § 30(2) BSIG: vulnerability management, access control with multi-factor authentication, and risk analysis for test and documentation systems. All three apply to every entity subject to NIS2, including municipal enterprises, utilities and IT service providers running internal platforms with web access.

• Vulnerability management (§ 30(2) no. 5): The provision explicitly covers "vulnerability handling and disclosure". External alerts, such as from a CERT, need a fixed intake channel and an assessment process.
• Access control (no. 9) and multi-factor authentication (no. 10): No. 10 requires "the use of multi-factor authentication or continuous authentication solutions". That includes web access to internal documentation platforms.
• Data held in test and documentation systems (no. 1): Test data and training materials with real personal data increase the damage. Such systems belong in the risk analysis under no. 1.

If a municipal enterprise or service provider subject to NIS2 were affected and had breached these obligations, § 65 BSIG would come into play. The range would be up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities. Above EUR 500 million in worldwide turnover, up to 2% or 1.4% of total turnover would be possible instead. The article on the fine tiers under § 65 BSIG explains the system, and the fine calculator provides an estimate.

Which Reporting Obligations Would Such an Incident Have Triggered in Germany?

At an entity subject to NIS2, a significant security incident would have triggered the staged reporting obligation under § 32 BSIG: an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after that. As personal data was involved, a notification to the data protection authority under Art. 33 GDPR would be due in parallel.

The deadlines in § 32 BSIG for the 24- and 72-hour reports run from awareness of the incident. The final report is due one month after the 72-hour notification; if the incident is still ongoing, a progress report comes first. When an incident crosses the threshold is explained in the article on the significant security incident.

Under Art. 33 GDPR, the supervisory authority must be notified where feasible within 72 hours of awareness. For how both channels interact, see NIS2 Incident Reporting: When, What, and to Whom?. The Rhysida leak in Berlin in August 2026 also hit a public administration.

In Vienna, the decisive alert came from outside, via CERT.at. For municipal enterprises, utilities and IT service providers subject to NIS2, that raises a concrete question: Would such an alert reach you, and who would handle it?

Sources:

• City of Vienna, Rathauskorrespondenz, 30 September 2026: Wien: Datensicherheit hat hohen Stellenwert - Sicherheitslücke umgehend geschlossen
• ORF Wien, 30 September 2026: Cyberangriff auf Stadt Wien
• BSI: NIS-2 für die Landes- und Kommunalverwaltung
• § 29 BSIG (Federal administration entities), gesetze-im-internet.de
• § 30 BSIG (Risk management measures), gesetze-im-internet.de
• § 32 BSIG (Reporting obligations), gesetze-im-internet.de
• § 65 BSIG (Fine provisions), gesetze-im-internet.de
• Regulation (EU) 2016/679 (GDPR), EUR-Lex