November in cyberspace: several Estonian companies fell victim to invoice fraud

November in cyberspace: several Estonian companies fell victim to invoice fraud
Photo: Seiko Kuik

In November, the Incident Response Department of the Information System Authority (CERT-EE) recorded 647 cyber incidents with an impact that resulted in people, public authorities, and companies losing their data or money or in disruptions in the work of information systems. During the first 11 months of the year, the number of recorded incidents with an impact reached 5,597 – 86% more than during the same period last year.

The majority of incidents with an impact were related to phishing sites with 434 detected. Many people again fell victim to phishing messages sent on behalf of banks and courier companies, losing hundreds or even thousands of euros to cyber criminals. CERT-EE restricts access to these sites, informs web hosts about them, and shares information with its international partners.

Among the notable cyber incidents, the monthly review highlights the malware attack that was carried out against a dental clinic on 1 November, encrypting the data on its server – mainly X-ray images. The clinic did not have a working backup, meaning the data could not be restored. The attack originated via an open remote desktop (RDP) connection with an easy password. In light of the incident, RIA recommends reviewing both the services available online and password policies.

On 17 November, the website of the Consumer and Technical Regulatory Authority ttja.ee was hit by a denial-of-service attack. As a side effect, there were outages for seven minutes on a total of eighteen state agency websites managed by the Information Technology Centre of the Ministry of Finance. CERT-EE and RIA name servers were actively attacked in both October and November, but these attacks generally had no impact.