The Incident Response Department of RIA (CERT-EE) registered 395 cyber incidents with an impact during May. After a record 522 incidents in March, the number of incidents has fallen in recent months but is still higher than in spring last year.
Most of the incidents with an impact, as usual, were phishing sites, with 199 detected. More recently, there has been a rise in the number of phishing messages sent on behalf of courier companies, claiming that a parcel cannot be delivered because of a missing or incorrect address. The user will then be redirected to a phishing page to enter their bank card details. The sums involved range from a few dozen to several thousand euros.
At the same time, malware continues to spread: the automated monitoring of CERT-EE found 2,483 infected devices in Estonian cyberspace in a month and reported them to network owners. In half a year, this figure has increased by around a quarter.
Among the more significant service disruptions, the monthly review highlighted recurrent failures in the use of authentication services, lasting from a few dozen minutes to several hours. The customers of Elisa, Telia, and Tele2 experienced problems with Mobile-ID, whereas the customers of SEB Pank also had problems with Smart-ID and Mobile-ID. For example, in one case, the disruption was caused by a device failure and in another by an administration error.
On a few occasions, there were also problems with ticketing systems. On the morning of 7 May, the ticketing system of Elron was unavailable for an hour and a half due to a Ridango device failure and on 25 May, the tpilet.ee website was down for several hours due to a software failure.
On the morning of 2 May, the East Tallinn Central Hospital was hit by a power outage and one of the backup generators failed to work as expected, leaving a server room and the main communication node without power. As a result of the incident, the hospital’s patient portal iPatsient was inaccessible for four hours. On the evening of 24 May, the digital prescription and insurance verification services provided by the Health Insurance Fund were disrupted for two hours.
The monthly summary also gives an overview of RIA’s efforts to improve cyber security in Estonia and the situation in the rest of the cyber world. Cyber attacks linked to the war in Ukraine continued, but attacks also hit the Helsinki city government, Europol, one of Germany’s largest political parties, the CDU, and US energy giant Atlas Oil.
