Cyber Incident Victim: Ministry of Defence
Date:
Apr 2022
Location:
Finland
Summary
A denial of service attack disrupted the websites of Finland's Ministry of Defence and Ministry for Foreign Affairs, forcing both to take services offline while investigating the incident. The cyber attack coincided with a parliamentary address by Ukraine's president, though no attribution was provided. The defence ministry confirmed the outage stemmed from excessive traffic aimed at crashing its systems, while the foreign ministry worked to restore functionality and apologised for disruptions. Separately, Nordea Bank reported unrelated online service issues affecting customer savings accounts but clarified these were not cyber attacks, despite being targeted in a similar incident weeks earlier.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 8, 2022, the websites of Finland’s Ministry of Defence (Puolustusministeriö) and Ministry for Foreign Affairs experienced significant disruptions, with both services becoming inaccessible shortly before 1:00 PM local time. The Ministry of Defence publicly attributed the outage to a denial-of-service (DoS) attack, confirming the incident through a tweet and subsequent statements by Communications Chief Kristian Vakkuri. Vakkuri stated the ministry had proactively taken its website offline in response to the attack and initiated an investigation, though he declined to comment on potential perpetrators. Concurrently, the Ministry for Foreign Affairs acknowledged service disruptions via Twitter, noting technical teams were working to restore functionality and apologizing for user inconvenience. The timing coincided with Ukrainian President Volodymyr Zelensky’s live address to the Finnish Parliament, though no explicit link between the events was confirmed by officials.
The DoS attack overloaded the ministries’ web infrastructure with excessive traffic or malformed requests, a common tactic to crash or disable targeted systems. While the defence ministry confirmed the attack’s nature, no further technical specifics—such as attack vectors, traffic volume, or duration—were disclosed. Separately, Nordea Bank reported unrelated online service disruptions affecting customer savings accounts on the same day, though it clarified these were not cyberattack-related. This distinction followed Nordea’s experience with a confirmed DoS attack in early March 2022. Both ministries maintained operational continuity for core functions despite the public-facing website outages, with no reports of data breaches or collateral damage to internal systems. Restoration timelines and long-term impacts were not detailed in initial statements.