Cyber Incident Victim: Eir
Date:
Apr 2014
Location:
Ireland
Summary
A telecommunications provider experienced unauthorized access to its email service perimeter, prompting an immediate shutdown to mitigate threats affecting 350,000 users. The company notified data protection authorities and restored webmail access within hours, ensuring delayed emails were delivered; while no evidence indicated broader system compromise or customer data exposure, users were advised to change passwords proactively as a precaution. Support channels included Twitter, online chat, and a dedicated phone line for incident-related inquiries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 30, 2014, Ireland-based telecommunications provider Eircom detected unauthorized access to the perimeter of its email service infrastructure. The company responded by immediately shutting down its email system to contain the intrusion, disrupting service for its 350,000 eircom.net email users. Eircom publicly disclosed the incident through an alert on its community forum, confirming it had followed established security protocols and industry best practices to eliminate threats to user accounts. While the breach was isolated to the email service perimeter, the company proactively notified Ireland’s Office of the Data Protection Commissioner and other relevant regulatory bodies about the potential compromise. No evidence indicated that attackers had accessed other internal systems or exfiltrated customer data during the incident. As a precautionary measure, Eircom advised all email users to change their passwords immediately and maintain regular password updates going forward.
Approximately two hours after the initial service disruption, Eircom restored webmail access and confirmed that all undelivered emails caused by the shutdown had been successfully delivered to recipients. The company continued investigating the breach’s origin but did not publicly identify suspected threat actors or disclose technical details about the intrusion method. Eircom directed customers with questions to contact support through its Twitter account, online chat service, or telephone helpline (1901). Service restoration concluded the active response phase, with no further disruptions reported following the initial containment actions. The incident remained confined to email infrastructure, with no reported financial or data theft impacts beyond the temporary service outage.