{
  "id": "56d1c725-0ac8-4153-a696-aa22f1f4e60d",
  "url": "https://tagesschau.de/inland/gesellschaft/bahn-stoerung-it-cyberangriff-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "2",
  "tags": [
    "cyberattacks",
    "DDoS",
    "Deutsche Bahn",
    "critical infrastructure",
    "IT disruption",
    "Germany"
  ],
  "nodes": [],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Ongoing Problems at Deutsche Bahn Caused by Cyberattack",
  "description": "Deutsche Bahn is affected by a continuing cyberattack on its IT systems causing disruptions in connection search and ticketing. The attack is characterized as a DDoS (Distributed Denial of Service) attack targeting DB systems in waves, starting Tuesday midday, 18 February 2026. Deutsche Bahn initially reported no restrictions but reversed this after experiencing fresh issues in the morning, confirming severe ongoing impacts. The company emphasizes that defense measures are active and it is cooperating with federal authorities, though it refuses to comment on speculations regarding the attackers' motives or identity. The head of the Federal Office for Information Security (BSI) warned the attack involves billions of requests per minute, defining it as a large-scale, exceptional DDoS attack of unprecedented dimension. Both the Bahn website (bahn.de) and the DB Navigator app are affected, impeding customers from searching connections and completing ticket purchases. The Federal Ministry of the Interior has withheld commenting on the investigation, citing the early stage of proceedings.",
  "summary_short": "Deutsche Bahn suffers ongoing IT disruptions due to a targeted DDoS cyberattack starting from Tuesday midday, affecting ticketing and connection search systems.",
  "summary_extended": "Deutsche Bahn has been suffering from continuing IT disruptions caused by a significant Distributed Denial of Service (DDoS) cyberattack that began on Tuesday, 18 February 2026 around midday. The attack, targeting Deutsche Bahn systems in waves, has led to problems with connection searches, ticket display, and completing bookings on both the Bahn-App 'DB Navigator' and the website bahn.de. Initially, Deutsche Bahn had indicated the issues were resolving, but later revoked that assurance and confirmed severe ongoing impacts. Deutsche Bahn is working closely with federal authorities but has declined to comment on the attack’s origins, emphasizing customer data protection and system availability as top priorities. The head of Germany's Federal Office for Information Security (BSI) described the incident as an unusually large-scale attack generating billions of requests per minute, highlighting the unprecedented dimension of the DDoS assault. The Federal Ministry of the Interior refrained from commenting on investigation status, citing the very early phase of inquiry.",
  "actor_primary": "Deutsche Bahn",
  "target_primary": null,
  "location_text": "Germany",
  "location_region": null,
  "location_coordinates_lat": 51.1657,
  "location_coordinates_lon": 10.4515,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly states that Deutsche Bahn is targeted by a large-scale, ongoing cyberattack identified as a DDoS attack. The source includes official statements from Deutsche Bahn and the German Federal Office for Information Security (BSI), clearly attributing the event as a hostile aggressor action affecting critical transport infrastructure IT systems.",
  "event_time_utc": "2026-02-18T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm6h",
  "created_at": "2026-02-18T19:29:00.031Z",
  "updated_at": "2026-11-08T19:50:28.957Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_6h",
  "severity_band": "significant",
  "attribution_confidence_band": "low",
  "attribution_basis": "single_source"
}

{
  "id": "56d1c725-0ac8-4153-a696-aa22f1f4e60d",
  "url": "https://tagesschau.de/inland/gesellschaft/bahn-stoerung-it-cyberangriff-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "2",
  "tags": [
    "cyberattacks",
    "DDoS",
    "Deutsche Bahn",
    "critical infrastructure",
    "IT disruption",
    "Germany"
  ],
  "nodes": [],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Ongoing Problems at Deutsche Bahn Caused by Cyberattack",
  "description": "Deutsche Bahn is affected by a continuing cyberattack on its IT systems causing disruptions in connection search and ticketing. The attack is characterized as a DDoS (Distributed Denial of Service) attack targeting DB systems in waves, starting Tuesday midday, 18 February 2026. Deutsche Bahn initially reported no restrictions but reversed this after experiencing fresh issues in the morning, confirming severe ongoing impacts. The company emphasizes that defense measures are active and it is cooperating with federal authorities, though it refuses to comment on speculations regarding the attackers' motives or identity. The head of the Federal Office for Information Security (BSI) warned the attack involves billions of requests per minute, defining it as a large-scale, exceptional DDoS attack of unprecedented dimension. Both the Bahn website (bahn.de) and the DB Navigator app are affected, impeding customers from searching connections and completing ticket purchases. The Federal Ministry of the Interior has withheld commenting on the investigation, citing the early stage of proceedings.",
  "summary_short": "Deutsche Bahn suffers ongoing IT disruptions due to a targeted DDoS cyberattack starting from Tuesday midday, affecting ticketing and connection search systems.",
  "summary_extended": "Deutsche Bahn has been suffering from continuing IT disruptions caused by a significant Distributed Denial of Service (DDoS) cyberattack that began on Tuesday, 18 February 2026 around midday. The attack, targeting Deutsche Bahn systems in waves, has led to problems with connection searches, ticket display, and completing bookings on both the Bahn-App 'DB Navigator' and the website bahn.de. Initially, Deutsche Bahn had indicated the issues were resolving, but later revoked that assurance and confirmed severe ongoing impacts. Deutsche Bahn is working closely with federal authorities but has declined to comment on the attack’s origins, emphasizing customer data protection and system availability as top priorities. The head of Germany's Federal Office for Information Security (BSI) described the incident as an unusually large-scale attack generating billions of requests per minute, highlighting the unprecedented dimension of the DDoS assault. The Federal Ministry of the Interior refrained from commenting on investigation status, citing the very early phase of inquiry.",
  "actor_primary": "Deutsche Bahn",
  "target_primary": null,
  "location_text": "Germany",
  "location_region": null,
  "location_coordinates_lat": 51.1657,
  "location_coordinates_lon": 10.4515,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly states that Deutsche Bahn is targeted by a large-scale, ongoing cyberattack identified as a DDoS attack. The source includes official statements from Deutsche Bahn and the German Federal Office for Information Security (BSI), clearly attributing the event as a hostile aggressor action affecting critical transport infrastructure IT systems.",
  "event_time_utc": "2026-02-18T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm6h",
  "created_at": "2026-02-18T19:29:00.031Z",
  "updated_at": "2026-11-08T19:50:28.957Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_6h",
  "severity_band": "significant",
  "attribution_confidence_band": "low",
  "attribution_basis": "single_source"
}