Cyber Incident Victim: Ministerstvo práce a sociálních věcí
Date:
Jan 2024
Location:
Czechia
Summary
The Ministry of Labour and Social Affairs experienced a DDoS attack causing temporary disruptions to its web services and online platforms, including those of the Labour Office, while IT specialists mitigated impacts and confirmed no sensitive citizen data was compromised. Concurrently, widespread fraudulent calls and SMS messages impersonating the ministry targeted citizens, falsely claiming housing allowance approvals and attempting to harvest personal information or banking credentials through phishing links.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 23, 2024, the Czech Ministry of Labour and Social Affairs (Ministerstvo práce a sociálních věcí, MPSV) experienced a distributed denial-of-service (DDoS) attack targeting its digital infrastructure. The attack disrupted the availability of web services and online platforms operated by both MPSV and the Labour Office of the Czech Republic (Úřad práce ČR), causing temporary operational interruptions. IT specialists from MPSV immediately initiated response protocols to mitigate the attack's effects, focusing on restoring service availability while preventing potential secondary damage. The incident did not compromise any citizen-sensitive data or permit unauthorized access to personal information, according to official statements. No evidence suggested system infiltration beyond the availability disruption caused by the volumetric attack. The DDoS incident represented an isolated availability disruption rather than a data breach or system compromise.
MPSV cybersecurity teams maintained continuous mitigation efforts throughout the attack duration, though the precise timeline of service restoration remains unspecified in public communications. The ministry issued public assurances regarding data security while acknowledging the temporary disruption to digital services. Post-incident measures included enhanced cybersecurity monitoring and infrastructure hardening initiatives to prevent recurrence. MPSV committed to ongoing public updates regarding both operational status improvements and long-term security enhancements. No attribution claims or threat actor details were provided in official communications. The incident occurred against a backdrop of separate, unrelated phishing campaigns impersonating MPSV that had been reported earlier that month, though these represented distinct threats without direct operational connection to the January 23 DDoS event.