Hasičský záchranný sbor Královéhradeckého kraje

Summary

The fire rescue service of Hradec Králové and Zlín regions was targeted in a cyber attack that compromised parts of its IT infrastructure. In response, the organization disconnected affected workstations from its network, implemented alternative communication channels to maintain operational readiness, and began analysing the extent of the damage while restoring compromised systems. The incident is being investigated by the Police of the Czech Republic’s National Centre against Terrorism, Extremism and Cybercrime, with support from the National Cyber and Information Security Authority, and no further details have been released while the inquiry continues.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Monday 24 March 2025, the Hasičský záchranný sbor Královéhradeckého and Zlínského kraje suffered a cyber attack. The attack was reported by mluvčí Jan Kocourek. Immediate measures were taken at the directly affected regions and other HZS regions to avoid limiting operational activity and command. A replacement communication method was introduced in the affected regions to prevent endangering operational capability and assistance to citizens during emergencies.

IT specialists disconnected the affected workstations from the common network. They are analyzing the extent of damage and restoring the compromised systems. Cooperation with the National Office for Cyber and Information Security (NÚKIB) and other state administration bodies is ongoing to implement further necessary security measures. The situation is also being handled together with the Police of the Czech Republic, and no further information will be provided during the investigation.

Criminal investigators are handling the case, with the National Centre against Terrorism, Extremism and Cybercrime (NCTEKK) conducting the investigation. Police spokesperson Jakub Vinčálek confirmed they received the report and are investigating, but will not provide further details. NÚKIB spokesperson Alžběta Dvořáková stated the office is intensively dealing with the Monday attack on firefighters in the two regions, but cannot currently disclose specifics such as the type of attack, origin, or whether it lasted only Monday. She emphasized they are providing cooperation but cannot say more while the investigation proceeds.

Sources

Sources available to members: 2 sources.