Cyber Incident Victim: Holy See
Date:
Nov 2022
Location:
Holy See
Summary
The Vatican's official website and associated domains experienced extended downtime due to a suspected cyberattack, prompting technical investigations into unusual access attempts. The Ukrainian ambassador to the Vatican attributed the incident to Russian actors, suggesting it was retaliation for the Pope's recent criticism of ethnic minorities within Russian forces involved in the Ukraine conflict. This followed Russian officials expressing outrage over the Pontiff's remarks about groups such as Chechens and Buryats participating in wartime atrocities. The attack rendered multiple organizational websites inaccessible for several hours, with primary services remaining disrupted into the evening.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 30, 2022, multiple Vatican websites including the primary domain vatican.va experienced extended outages following unusual access attempts, prompting technical investigations by Vatican authorities. The incident began during the afternoon when several official sites became inaccessible to users for several hours. By evening, vatican.va remained offline, indicating sustained disruption. Vatican spokesperson Matteo Bruni publicly acknowledged the incident, confirming abnormal traffic patterns but refraining from immediate attribution. The outage coincided with heightened geopolitical tensions following Pope Francis’s November 28 interview, where he suggested non-ethnic Russian combatants—specifically naming Chechens and Buryats—were responsible for particular brutality in Russia’s invasion of Ukraine.
Ukrainian Ambassador to the Holy See Andrij Jurasch directly attributed the cyberattack to “Russian terrorists,” asserting it represented retaliation for the Pope’s statements. Jurasch framed the incident on Twitter as emblematic of Russian political aggression, linking it to Moscow’s earlier diplomatic protests against the Pontiff’s remarks. Russian officials had condemned the Pope’s characterization of minority involvement in the war as “outrageous” prior to the cyber incident. The attack’s operational impact was confined to website unavailability, with no reported data breaches or secondary system compromises. No ransomware claims or hacktivist statements emerged. Vatican technical teams worked to restore services without disclosing mitigation specifics, while the incident amplified public scrutiny of cyber operations amid the Ukraine conflict’s information warfare landscape.