Cyber Incident Victim: Ministerstvo práce a sociálních věcí
Date:
Mar 2021
Location:
Czechia
Summary
A large-scale cyber attack targeted public administration systems in Prague, including the Ministry of Labour and Social Affairs, prompting an immediate email system outage to mitigate risks. Servers sustained minimal damage with no data loss due to redundant backups, and recovery from backups proved unnecessary. The National Cyber and Information Agency coordinated the response, linking the incident to actively exploited vulnerabilities in Microsoft Exchange Servers previously identified as critical risks. While the Ministry found no evidence of compromised data or systems, investigations continued with law enforcement collaboration. This attack followed a pattern of similar breaches affecting Czech state infrastructure in recent months.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 5, 2021, Prague Mayor Zdeněk Hřib announced via Twitter that the city’s public administration systems had experienced a large-scale cyberattack. The attack targeted municipal servers, prompting an immediate outage of the email system as a security measure. Hřib reported minimal damage, attributing the preservation of data to redundant storage systems that maintained multiple copies. By the morning of March 5, email functionality had been restored without requiring data recovery from backups. The mayor indicated that city districts received timely warnings about the incident. The Czech Ministry of Labour and Social Affairs confirmed it was also targeted, though Minister Jana Maláčová provided no additional specifics. A ministry spokesperson stated they were assessing the situation but preliminarily found no evidence of data leaks or system damage.
The Czech National Cyber and Information Agency (NUKIB) was notified and collaborated with affected entities, including Prague’s administration and the Ministry of Labour and Social Affairs. NUKIB worked alongside the National Center against Organised Crime to mitigate damage but declined to disclose further details about the attack’s scope or specific targets. The agency highlighted prior warnings about critical vulnerabilities in Microsoft Exchange Server, which enabled remote access to email accounts and were being actively exploited. NUKIB urged organizations using internet-accessible Exchange servers to apply updates immediately. This incident followed a pattern of cyberattacks against Czech state entities in the preceding year, including Prague Airport and healthcare facilities.