Science & Tech · Cybersecurity · 1 hr ago
DNSSEC key change disrupts some healthcare connections to Germany’s TI
Some practices, pharmacies and hospitals have connection problems with Germany’s Telematics Infrastructure, the network used for healthcare services.
The disruption affects facilities using Secunet or RISE connectors and certain VPN access services.
A change to the internet’s top DNS security key on October 11 appears to have triggered the problem: affected connectors may not recognize the new key and cannot look up the addresses needed to connect.
This can interrupt services such as electronic prescriptions, patient records and medical communications.
Existing connections may keep working, but restarting a connector could break its connection if the problem has not been corrected.
Gematik has a manual workaround for Secunet devices, which the facility’s technical support provider must apply; facilities with problems should contact that provider.
RISE-specific instructions are still pending, and manufacturers are working on an automatic fix.
FinishThe End⁈
Some German healthcare providers have lost or face disruption to connections with the country’s Telematics Infrastructure (TI).
The problem affects facilities using Secunet or RISE connectors linked through Arvato or T-Systems VPN access services.
A change to the internet’s DNSSEC root key left the affected connectors apparently without the new trust anchor needed to resolve VPN service addresses.
Gematik advises affected facilities not to restart connectors before a correction is applied.
A workaround is available for Secunet connectors, while Gematik says guidance for RISE devices is still to come.
- Who
- Healthcare providers using Secunet or RISE connectors, including doctors’ practices, pharmacies and hospitals.
- What
- Some connectors cannot establish or maintain connections to the TI services.
- When
- The disruption began on Monday; the new root key has been signing the root DNSKEY record since 11 October 2026.
- Where
- Germany’s Telematics Infrastructure.
- Why
- The affected connectors apparently lack the new DNSSEC root trust anchor and cannot resolve the addresses of VPN access services.
This story does not have two clearly opposing sides.
RISE was scheduled to make firmware version 6.2.3 available through its configuration and software repository.
The new root key KSK-2024 began signing the root DNSKEY record, replacing KSK-2017 for that purpose.
Healthcare facilities began reporting problems connecting to the TI.
- Affected connectors
- Secunet and RISE
- VPN access providers
- Arvato and T-Systems
- New root key
- KSK-2024, key tag 38696
- Previous root key
- KSK-2017, key tag 20326
- DNSKEY cache TTL
- 48 hours
- RISE firmware
- Version 6.2.3 was scheduled from 8 October 2026
What people are saying
important corrective measure
Sources
Related news
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Amadeus booking-system flaw exposed airline passenger data
Cyberattack affects 80 stores of French supermarket chain Co-operative U
Canadian cybersecurity executive arrested on federal extortion charges
AI safety can draw on cybersecurity collaboration, technology veteran says
Zscaler adds Claude Mythos 5.1
Attackers target critical SonicWall SMA 1000 flaw days after disclosure
Frontier AI models completed all eight industrial-control attack tests
AI agent changed severity ratings for 75.1% of cloud security findings
Cyberattack disrupts cooling systems at hundreds of French supermarkets
Cybersecurity job openings span roles in several countries
