Cyber Incident Victim: SNCB
Date:
Jan 2024
Location:
Belgium
Summary
The Belgian railway operator SNCB/NMBS experienced a significant DDoS cyberattack overnight, disrupting its website, mobile application, and station information displays. The attack overloaded systems with excessive traffic, prompting immediate deactivation of digital platforms for security reasons. Services were fully restored by morning after approximately five hours of disruption. This outage prevented passengers from accessing real-time travel updates following previous snow-related service interruptions and blocked online ticket purchases. The company publicly apologized for the inconvenience and announced plans to pursue legal action against the perpetrators.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On the night leading into Thursday, January 18, 2024, the Belgian national railway company NMBS/SNCB experienced a significant cyberattack described by officials as a "large-scale" incident. The attack began around 2:00 AM when threat actors launched a distributed denial-of-service (DDoS) assault targeting the company's website. This type of attack overwhelms online systems by flooding them with excessive traffic, rendering them incapable of processing legitimate requests. As a security precaution, NMBS/SNCB immediately deactivated its website upon detecting the attack. The disruption subsequently affected multiple critical passenger information systems, including the railway's mobile application and real-time departure/arrival screens installed across Belgian train stations. Company spokesperson Bart Crols confirmed these technical failures persisted through the early morning hours, coinciding with peak commute times.
The cascading system failures created substantial operational challenges during recovery from severe winter weather that had disrupted services the previous day. Passengers could not access digital platforms to verify train schedules, purchase tickets online, or confirm service restoration following snow-related cancellations. This information blackout persisted until approximately 7:30 AM when technicians fully restored all affected systems. NMBS/SNCB issued a public apology late Thursday morning acknowledging the disruption's impact on travelers and announced its intention to file criminal charges against the perpetrators. No evidence suggested passenger data compromise or financial theft during the incident. Service normalization occurred within five and a half hours of initial detection, with all digital platforms and station information displays returning to full functionality by the stated resolution time.