Cyber Incident Victim: FCSB
Date:
Feb 2025
Location:
Romania
Summary
FCSB reported that its website suffered adistributed denial‑of‑service attack that disrupted online ticket sales for an upcoming Europa League match against Olympique Lyon. The attack, generated by a botnet, overwhelmed the server and triggered more than 200 malicious traffic spikes, while over 10,000 users attempted to access the site. The club’s ticketing team worked to identify and block the traffic in real time, aiming to restore service before the match.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Tuesday, February 25, 2025, Romanian football club FCSB announced that its website had been subjected to a Distributed Denial of Service (DDoS) attack. The attack disrupted the online ticketing process for the club’s upcoming Europa League round of 16 match against Olympique Lyon. According to the club’s statement, a DDoS attack functions by employing a large number of compromised devices, commonly referred to as a botnet, to flood a server, network, or online service with traffic, thereby rendering it inaccessible to legitimate users. FCSB disclosed that, at the moment of the announcement, more than 10,000 users were attempting to access the ticketing platform simultaneously. The club also reported that its security teams had already detected and neutralized over 200 individual DDoS attempts targeting the site.
The disruption prevented fans from completing ticket purchases for the March 6, 2025 fixture scheduled to be held at the National Arena in Bucharest. In response, FCSB’s ticketing department indicated that it was actively working to identify and block the malicious traffic in real time to restore normal service. The club expressed confidence that the issue would be resolved as quickly as possible, allowing ticket sales to resume. No further details about the origin of the attack or the specific mitigation measures employed were provided in the announcement. The statement concluded with a note that the club remained focused on ensuring supporters could secure tickets for the Europa League encounter.