- There were disruptions to the national authentication service and SMIT’s services. The Russian pizza chain Dodo Pizza was hit by a cyber attack. We were notified of several data breaches in October.
- We carried out a prevention campaign focusing on scams and reporting fraudulent websites.The first RIA CyberMeetUp of the season took place. Our blog covered fake job offers on LinkedIn and the use of booking system data to send scam messages.
- The refrigerator control systems of Danish refrigeration equipment manufacturer Danfoss were hit by a cyber attack. Other attacks also targeted IDC Frontier, one of the leading cloud service providers of Japan, and Fakturownia, one of the largest invoicing management platforms of Poland.
Incidents reported to CERT-EE that had an impact on the confidentiality, integrity, or availability of data or information systems.
Phishing sites account for the largest proportion of incidents recorded by CERT-EE.
Situation in Estonian cyberspace
On 1 October, between 12.25 and 1.45 p.m., disruptions affected the use of the state authentication service GovSSO, potentially preventing users from logging in to several state e-services. The state authentication service also experienced repeated disruptions in both September and October, causing problems with logging in to several public sector e-services. The causes of these disruptions varied: one incident involved a distributed denial-of-service (DDoS) attack, while the others were caused by technical issues. We are continuing our efforts to improve the reliability of the service to reduce the likelihood of similar disruptions recurring and minimise their impact on users.
The Russian pizza chain Dodo Pizza, which also operates in Estonia, was hit by a cyber attack on 27 and 28 September. The attack may have resulted in the exposure of the names, contact details, and dates of birth of up to 68 million customers. According to the company, the criminals gained access primarily to the data of Russian customers. However, the group claiming responsibility for the attack says that the database it stole also contains the data of approximately 256,000 Estonian customers and that it plans to sell the database. The company says it has notified the Estonian Data Protection Inspectorate and is investigating the incident and its impact on the data of Estonian customers.
SMIT’s services experienced disruptions on two occasions. On 6 October, between 8.20 and 10.22 p.m., disruptions affected the Interpol, PIKO (Border Control Information System), and APOLLO (e-Police) services managed by SMIT. As a result, border checkpoint operations were disrupted, and police patrols were unable to run vehicle registration plate checks. The disruptions were caused by a temporary instability in Interpol’s services. On 13 October, between 2.20 and 3.28 p.m., an outage occurred at the SMIT data centre, causing database connectivity issues in several services. The outage affected nearly 26 different services.
We were notified of several data breaches in October. On 8 October, a company providing booking solutions to accommodation establishments discovered that the data of approximately 9,000 customers had been leaked from its systems. The exposed data included names, telephone numbers, email addresses, and booking information. The breach was made possible by a security vulnerability in an application programming interface (API), which has since been fixed. In addition, a data breach occurred at a classified advertising portal, where a vulnerability in third-party software resulted in the exposure of the data of up to 5,000 users, including their names, dates of birth, email addresses, telephone numbers, and home addresses. The company discontinued its use of the software responsible for the data breach.
A disruption affecting the List of Trusted Lists managed by the European Commission also caused problems for Estonian e-services. On 21 October, between 12.22 and 11.09 a.m., the List of Trusted Lists (LOTL), managed by the European Commission, was unavailable. The list contains information about trust service providers in EU Member States and the trust services they offer. As a result, disruptions also affected Estonian e-services, including digital signing, the health information system, the Delta document management system, as well as the operations of one bank and other companies.
Several critical vulnerabilities affecting Estonian systems also came to light in October. We warned about two of them on our blog. On 21 October, security patches were released for two critical vulnerabilities in the PHP server software. If successfully exploited, these vulnerabilities could allow an attacker to execute commands on a system without prior authentication. PHP is widely used in web applications, internet-connected and internal information systems, and container environments. Therefore, these vulnerabilities pose a significant risk to a large number of information systems. An update was also released on the same day to address a critical security vulnerability in GitLab. This vulnerability could allow an attacker to execute malicious code on a server without having a user account and potentially gain control of the server. As GitLab servers may store the source code, access credentials, and other sensitive data of an organisation, the security update should not be delayed.
Activities of the Estonian Information System Authority
October is Cybersecurity Month, and, as in previous years, we ran a prevention campaign throughout the month. This year, the campaign focused on scams and encouraged people to pay attention to the email address of the sender or the address of a website. We also urged people to report fraudulent websites to [email protected] so that we could have them removed from the internet. Scammers frequently impersonate banks, government agencies, courier companies, and other well-known organisations in emails and text messages. The content may appear credible and familiar, but a closer look at the sender’s details or the web address may reveal that it is a scam. Elisa, Enefit, the Police and Border Guard Board, Omniva, and SEB are taking part in the campaign, which runs from 12 October to 8 November. Liis Klein, Prevention Manager at the Analysis and Prevention Department of RIA, also spoke about fraudulent websites and the ongoing awareness campaign on Kuku Radio. Mai Kraft, Director of NCSC-EE, also spoke about the campaign on Kanal2 show "Telehommik".
Through our ongoing cooperation with the University of the Third Age of the University of Tartu, we are bringing cybersecurity knowledge to nearly 3,400 older people across Estonia. The training courses, which run from October to April, teach participants how to recognise scam calls, investment scams, and phishing attempts to avoid falling victim to fraud. The courses are held as part of the programmes of the University of the Third Age of the University of Tartu in various locations across Estonia. The first RIA training session takes place in Tartu on 29 October, and the last one will be held on Hiiumaa on 16 April. All lecture programmes of the University of the Third Age are free of charge for participants and are open to anyone aged 60 or over. 270 people participated in the training in Tartu. Read more on our website.
We wrote a blog post about incidents that have occurred in recent months in which scammers gained access to data held by booking systems and used the information obtained to send convincing fraudulent messages. In several cases, people who had booked accommodation or a beauty treatment, for example, subsequently received a message asking them to reconfirm their booking and enter their payment card details. We described one specific incident and included examples of the messages involved. We also highlighted four warning signs to look out for. Read more on our blog.
On 8 October, the first RIA CyberMeetUp of the season took place. This time, the speakers were Lauri Tankler (RIA), Martti Kebbinau (Bluehat, Cyber Escape Room), Peadar Charles Callaghan (Tallinn University, Cyber Escape Room), and Siret Schutting (Digital Round Table, Excalibur Group). The event was held at the Palo Alto Club, where participants could attend in person. Those who preferred not to attend in person could watch the live stream on the YouTube, LinkedIn, and Facebook channels of RIA. Recordings of the event can be viewed on YouTube. The next RIA CyberMeetUp will take place on 12 November.
Mai Kraft, Director of NCSC-EE, wrote an opinion piece about the recent increase in data breaches. According to Mai, our society depends on digital infrastructure in almost every aspect of life, including areas that we ourselves may not consider critically important. Data breaches have recently become almost commonplace, and we are no longer paying sufficient attention to them. However, serious harm can occur when, for example, someone’s health data falls into the wrong hands. Maintaining trust is not solely the responsibility of cybersecurity experts – it is also a matter of organisational management. Read more in the opinion piece on Delfi.
We also wrote about fake job offers on LinkedIn that may conceal cyber attacks. In recent months, we have seen several cases in which criminals have used fake job offers to trick people into running malware on their computers. Software developers are the primary targets of these attacks. In one recent case, during what appeared to be a job interview, a person downloaded a software project containing malicious code onto their computer and consequently lost control of a cryptocurrency wallet holding nearly USD 10,000 worth of cryptocurrency. Read more about this scam on our blog.
Together with the Tehnopol Startup Incubator and the European Cybersecurity Competence Centre (ECCC), we are running the Cyber Accelerator, which supports cybersecurity start-ups in developing and bringing new products and services to market. The aim of the Cyber Accelerator is to promote innovation and entrepreneurship in the cybersecurity sector and help to bring new technological solutions to market. Over a period of seven months, the companies selected for the programme can develop their products and services with the support of experienced mentors and industry experts.Seven companies were selected for the fourth round of the accelerator. Their solutions help, among other things, prevent cyber fraud, protect sensitive data, and improve the cybersecurity of organisations. Read more about the companies selected for the Cyber Accelerator on our website.
International situation
Fakturownia, one of the largest invoicing management platforms in Poland, was hit by a cyber attack, which likely also resulted in a leak of customer data. Fakturownia is used by more than 600,000 companies in Poland and abroad. It is not yet known how many of them have been affected by the data breach. The leaked information is believed to include companies’ account details, password hashes, and information about customers. Payment card details were not compromised. The attack attracted particular attention in Poland because Fakturownia is also integrated with the national e-invoicing system operated by the Polish tax authority, which is mandatory for a number of companies. However, the company has confirmed that the national e-invoicing system was not affected by the attack.
The Minister for Digital Affairs of Denmark confirmed that criminals had managed to gain access to data relating to approximately 8.8 million people in the national population register database, including some deceased people and people who had moved abroad. The data included names, contact details, and personal identification codes. Access was gained through a Danish company that was legally authorised to query the population register. According to the Danish newspaper Politiken, the attackers exploited the administrator passwords of the company, which were very easy to guess. The details of the attack and its exact impact are still under investigation. The identity of those behind the attack has also not yet been made public. In response to the attack, a comprehensive security audit of the information systems of the population register has been commissioned.
IDC Frontier, one of Japan’s leading domestic cloud service providers, was hit by a ransomware attack on 7 October. The company has since announced that the attack has affected 495 organisations, including local governments, logistics companies, police forces, food sector businesses, and travel agencies. The attackers sent the company a message claiming that the attack took just seven minutes and resulted in the encryption of at least 225 databases. The cloud provider has already informed some customers that their data cannot be restored from the cloud and that they will have to recover it from their own backups.
On 8 October, Italy’s Ministry of Foreign Affairs announced that its website had come under cyber attacks. The announcement did not specify whether these were denial-of-service attacks or something more serious. However, thanks to the security measures in place, the website remained operational. The attacks were most likely carried out by pro-Russian hacktivists. One group also listed the websites of several Italian embassies among its targets on its channel. The Ministry of Foreign Affairs stated that Italy would like to see more action at the EU level to identify those responsible for such attacks and would submit proposals to this effect together with Romania and other countries.
On the night of 11–12 October, a cyber attack targeted the control units of certain models of refrigerators manufactured by Danish refrigeration equipment manufacturer Danfoss. The attack had a major impact in France, where goods stored in refrigerators were partially spoiled in approximately 700 shops. In some locations, the high temperatures also caused fires. The attackers exploited refrigerator control units running an older, unpatched version of the software that contained security vulnerabilities and had been exposed to the internet to enable remote management. The attackers managed to activate the defrost function, causing temperatures inside some refrigerators to rise to as high as 50 °C.
Researchers from the Citizen Lab of the University of Toronto and cybersecurity company Confiant published a report revealing that Israeli digital advertising company Discover-Tech had enabled spyware to be distributed through its advertising network. Users could become infected with spyware delivered through advertisements without having to click on anything or download anything. For example, devices belonging to Qatar-based broadcaster Al Jazeera were infected with the Israeli Candiru spyware in this way. Spyware-laden advertisements were also displayed to government agencies in more than 20 countries, including RIA, and international organisations, including NATO and EU institutions. The advertisements served by Discover-Tech contained code that secretly sent the IP address of the user to a Discover-Tech server in the background while the advertisement was being displayed. If the server identified the user as a potential target, spyware was then delivered. The campaign had a wide reach. According to the report, advertisements containing hidden callback code were displayed on 120,000 websites between March and June this year.
On 19 October, the German political party Alternative for Germany (AfD) announced that more than 420,000 emails and the contents of 48,000 documents had been leaked from its internal network. The hackers said they had acted in the interests of transparency in general, rather than for political reasons. An AfD representative confirmed that their service provider had been hit by a cyber attack involving data theft at the end of September and condemned the incident as an ‘attack on the party system of Germany and, consequently, on democracy itself’.
Binance, the world’s largest cryptocurrency exchange, was hit by a cyber attack in late October, in which hackers gained control of approximately 6.3 billion dollars’ worth of crypto assets. In terms of value, this is the largest cryptocurrency theft in history. According to the FBI and several blockchain security firms, the theft was carried out by TraderTraitor, a North Korean state-backed group, which is now attempting to launder the stolen cryptocurrency through various trading platforms. The attack reportedly began with a compromised laptop belonging to a Binance engineer, which the attackers used to gain access to the company’s systems. Binance suspended withdrawals following the attack, but confirmed that users’ funds are protected and that the company itself will cover all losses.
Last updated: 04.11.2026
