May in cyberspace: a rise in incidents with impact, more frequent fraud calls, and fake shops

May in cyberspace: a rise in incidents with impact, more frequent fraud calls, and fake shops

Among the cyber incidents with higher impact, the monthly overview of RIA highlights a ransomware attack on a company operating in Tallinn, disruptions at Tallinn Airport and East Tallinn Central Hospital, as well as an increase in fraudulent activities where criminals used fake online shops and made fraud calls on behalf of the Estonian Health Insurance Fund.

In May, attackers managed to encrypt the data of a company operating in Tallinn, making its business applications unusable. According to initial information, the attackers penetrated the systems of the company through outdated software security vulnerabilities six months ago. Ransomware attacks often originate either from unpatched software or from a Remote Desktop Protocol (RDP) connection open to the internet. The threat assessment of RIA (in Estonian) provides recommendations on how to prevent ransomware attacks.

In the second half of May, there were two notable cases in Estonia where temporary IT failures disrupted public services. Both situations were resolved swiftly and the systems were back up and running within hours. During the night of 17 May, the automated border control system of Tallinn Airport was disrupted, affecting passengers on four different flights. On 29 May, East Tallinn Central Hospital was hit by a major IT failure, leading to a state of crisis being declared – the emergency department was rerouted and scheduled operations were postponed.