// CONFIRMED RANSOMWARE ATTACKS · COUNTRY
Ransomnews has confirmed 40 ransomware attacks in Austria between May 2020 and August 2026, each one verified against a public source such as a breach notification, regulatory filing, court record or press report. That is 0.4% of the 9,520 confirmed incidents in the dataset. So far in 2026, 10 have been confirmed, against 8 in 2025 and 3 in 2024. The most affected sector is manufacturing, with 10 confirmed victims (25%). Vienna is the city with the most confirmed victims, at 6. Where the operator is attributed, LockBit leads with 6 confirmed victims. A ransom payment is on the public record in 1 case and a refusal in 6; the outcome is unrecorded in the remaining 33.
Confirmed ransomware attacks in Austria by year
The current year is a partial count. Confirmation lags the attack itself, so recent months keep filling in after the fact; read a low figure for the latest year as incomplete rather than as a decline.
| Year | Confirmed attacks | Ransom paid (public) | Ransom refused (public) |
|---|---|---|---|
| 2020 | 5 | 0 | 0 |
| 2021 | 4 | 1 | 0 |
| 2022 | 6 | 0 | 2 |
| 2023 | 4 | 0 | 0 |
| 2024 | 3 | 0 | 1 |
| 2025 | 8 | 0 | 1 |
| 2026 (year to date) | 10 | 0 | 2 |
Which ransomware groups attack organisations in Austria most
The operator is attributed in 30 of the 40 confirmed incidents. Counts are confirmed victims, not leak-site claims, so they run well below the totals the groups publish about themselves. Group names link to the live Ransomtracker profile where one exists.
Most active groups by confirmed victims
Where the confirmed attacks in Austria fall
Most affected sectors
Cities with the most confirmed victims
Ransom payment outcomes in Austria
Among the 7 confirmed incidents in Austria where the outcome is on the public record, 1 paid and 6 refused, a disclosed payment rate of 14.3%. The remaining 33 carry no public statement either way. Victims that pay have every incentive to stay quiet and public bodies are the most likely to announce a refusal, so treat this as the disclosed rate, not the true one. The ransomware payment rate analysis explains how the disclosed rate has moved since 2018 and how it compares with incident-response firm samples.
Largest confirmed ransomware attacks in Austria by records exposed
Record counts are recorded only where a named source disclosed them, which is the minority of cases, so this table ranks disclosed impact rather than true impact.
| Date | Organisation | Sector | Location | Records | Group | Ransom paid | Source |
|---|---|---|---|---|---|---|---|
| August 2026 | Arbeiterkammer (Austrian Chamber of Labour) | Other | Salzburg, Austria | 270,000 | The Gentlemen | Unknown | ooe.orf.at |
Most recent confirmed ransomware attacks in Austria
The 25 most recently confirmed of 40 incidents, newest first. Every row links to the public source it was verified against.
| Date | Organisation | Sector | Location | Records | Group | Ransom paid | Source |
|---|---|---|---|---|---|---|---|
| August 2026 | Arbeiterkammer (Austrian Chamber of Labour) | Other | Salzburg, Austria | 270,000 | The Gentlemen | Unknown | ooe.orf.at |
| August 2026 | FREY WILLE | Retail | Vienna, Austria | — | Aur0ra | Unknown | kurier.at |
| June 2026 | Flughafen Wien - Vienna Airport | Transportation | Vienna, Austria | — | APT73/BASHE | No | noe.orf.at |
| May 2026 | Rhomberg Bau GmbH | Construction | Bregenz, Austria | — | — | Unknown | vorarlberg.orf.at |
| April 2026 | Abwasserverband Grazerfeld | Utilities | Wildon, Austria | — | LockBit | Unknown | kleinezeitung.at |
| April 2026 | B3 Bruck an der Mur | Education | Bruck, Austria | — | Payload | No | 5min.at |
| February 2026 | Marktgemeinde Langenzersdorf | Government | Langenzersdorf, Austria | — | — | Unknown | noe.orf.at |
| February 2026 | Landsteiner Elektrotechnik GmbH | Service | Klaus, Austria | — | LockBit | Unknown | landsteiner.net |
| February 2026 | CHS Villach | Education | Villach, Austria | — | The Gentlemen | Unknown | kleinezeitung.at |
| January 2026 | Gady Family | Retail | Lebring, Austria | — | The Gentlemen | Unknown | gady.at |
| December 2025 | Landessonderschule Mils | Education | Mils, Austria | — | — | Unknown | unsertirol24.com |
| November 2025 | Schmidt's Handelsgesellschaft mbH | Retail | Bürs, Austria | — | INC | Unknown | borncity.com |
| November 2025 | Woom GmbH | Manufacturing | Vienna, Austria | — | INC | Unknown | woom.com |
| October 2025 | MONDI Resort Grundlsee | Other | Grundlsee, Austria | — | Lynx | Unknown | kleinezeitung.at |
| September 2025 | VAS AG | Service | Wals, Austria | — | — | Unknown | vas.co.at |
| August 2025 | Infoniqa | Technology | Wels, Austria | — | Warlock | Unknown | heise.de |
| March 2025 | Maria Enzersdorf | Government | Maria Enzersdorf, Austria | — | — | Unknown | noe.orf.at |
| February 2025 | Stadtgemeinde Tulln | Government | Tulln, Austria | — | — | No | 5min.at |
| March 2024 | BFI Niederösterreich | Education | Wiener Neustadt, Austria | — | — | Unknown | kurier.at |
| February 2024 | Korneuburger Rathaus | Government | Korneuburger, Austria | — | LockBit | No | noen.at |
| January 2024 | WIFI Niederosterreich | Education | St. Polten, Austria | — | LockBit | Unknown | kurier.at |
| April 2023 | Anton Paar | Manufacturing | Graz, Austria | — | Black Basta | Unknown | kleinezeitung.at |
| February 2023 | Rosenbauer Group | Manufacturing | Leonding, Austria | — | LockBit | Unknown | rosenbauer.com |
| February 2023 | TroGroup | Manufacturing | Wels, Austria | — | LockBit | Unknown | trogroup.com |
| January 2023 | Admiral Sportwetten GmbH | Other | Wiener Neudorf, Austria | — | Play | Unknown | derstandard.de |
Frequently asked questions
How many ransomware attacks in Austria have been confirmed?
Ransomnews has confirmed 40 ransomware attacks in Austria since May 2020, including 10 so far in 2026. Each one is verified against a public source such as a breach notification, regulatory filing or press report. The true total is higher, because many victims never disclose; confirmed counts are a floor, not a ceiling.
Which ransomware group is most active in Austria?
LockBit, with 6 confirmed victims, followed by The Gentlemen (3) and ALPHV/BlackCat (2). These are confirmed victims, not leak-site claims, counted among the 30 incidents where the operator is attributed.
Which sector is hit most by ransomware in Austria?
Manufacturing, with 10 confirmed incidents (25% of the total). Education follows with 7, then Government with 7.
Which cities in Austria have the most confirmed ransomware attacks?
Vienna (6), Salzburg (2), Tirol (2), Wels (2), Bergheim (1). City is recorded where the victim organisation is headquartered or the incident was reported, so distributed organisations are counted once.
How often do ransomware victims in Austria pay the ransom?
Among the 7 confirmed incidents in Austria with a public outcome, 1 paid and 6 refused, a disclosed payment rate of 14.3%. Most victims never state whether they paid, and those who pay have the least reason to say so, so the disclosed rate understates real payment behaviour. The payment rate analysis tracks this figure since 2018.
What is the largest confirmed Austria ransomware attack by records exposed?
Arbeiterkammer (Austrian Chamber of Labour) (Salzburg, Austria, August 2026), with 270,000 records exposed according to ooe.orf.at. Record counts exist only where a source disclosed them, so this ranks disclosed impact.
How to read this page. Every incident counted here was verified by Ransomnews against at least one public source. Leak-site listings alone do not qualify, because operators inflate, duplicate and occasionally fabricate claims, so these totals are a defensible floor rather than a full census. Records exposed and ransom outcomes appear only where a named source disclosed them. The page is regenerated from the live database, which refreshes weekly. Cite as: Ransomnews Confirmed Ransomware Attacks Dataset, ransomnews.com, with a link to this page. Bulk access and methodology questions: [email protected]. See also the monthly ransomware statistics and the Ransomtracker.