The Incident Response Department of RIA (CERT-EE) recorded 430 cyber incidents with an impact in April, which is slightly above the average for the last six months. Phishing sites still account for the largest proportion of incidents recorded by CERT-EE.
Cyber attacks stemming from military activities continued in April. The US cyber agency CISA fell under a cyber attack. One of the largest platforms used by phishing scammers was closed down as a result of an international police operation.
There were a number of issues with the Examinations Information System in April, caused by system overload. In addition, the personal data of 539 people was publicly available on the GitHub page of the Examinations Information System. The personal data has now been removed and the Education and Youth Board has said it will notify the Data Protection Inspectorate of the breach.
This month, there were also a number of failures with digital signatures in the DigiDoc application. The interruption was caused by the renewal of certificates by SK ID Solutions. In addition, there were problems with updating the DigiDoc application on Windows devices. An error message was displayed to users who tried to update the application during that period and Microsoft Defender did not allow to launch the software. The incident was caused by human error: an unsigned file had been uploaded on the installer.id.ee page.
The Data Tracker – an eesti.ee state portal service that allows you to view queries related to your data – was unavailable for about 4 hours in the afternoon of 9 April. The interruption was caused by an error that occurred in the updating process.
On 26 April, there was a nationwide service disruption in the operation of information systems used by family physicians. The issuing of prescriptions and certificates for sick leaves as well as registering for appointments was disrupted due to the failure. The failure was caused by a power outage in the main server of Medisoft AS.
In April, we also saw DoS attacks with an impact. Three DoS attacks occurred against ts.ee, the website of the Port of Tallinn. In addition, the internet connection at Tallinn Industrial Education Centre was not available. The failure was caused by a cyber attack that overloaded the access channel used to provide an internet connection.
The RIA monthly summary also provides an overview of RIA’s work to improve cyber security in Estonia and of other developments in the cyberworld.
