Cyber Incident Victim: Jämtlands län
Date:
Dec 2023
Location:
Sweden
Summary
A cyberattack disrupted Härjedalens kommun's IT systems, forcing the municipality to activate crisis protocols and revert to manual processes such as paper-based record-keeping, severely impacting elderly care services due to inaccessible digital health records. Critical services like healthcare were maintained via telephone, while temporary email solutions were established for public inquiries. The organization refused to comply with attacker demands and initiated recovery efforts, including gradual system restoration and password resets, though full restoration remained ongoing.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 23, 2023, Härjedalens kommun experienced a significant IT attack that disrupted municipal IT systems, prompting activation of its crisis management organization. The attack compromised digital infrastructure, forcing staff across departments to revert to manual processes like paper-based record-keeping. This particularly impacted elderly care services, where digital health journals became inaccessible, hindering access to critical patient information. Despite these operational challenges, the municipality maintained essential healthcare and social services throughout the incident. Officials refused to engage with perpetrator demands, adhering to standard protocols against negotiating with cybercriminals. Security concerns prevented disclosure of specific ransom details or attacker communications. Initial disruptions required service adjustments, including temporary suspension of digital citizen interactions.
By January 4, 2024, recovery efforts showed progress with systems gradually returning online. The municipality implemented enhanced security measures including system-wide password resets. Email systems remained nonfunctional, necessitating a temporary email address for citizen inquiries. For urgent matters, residents were directed to phone contacts during business hours or emergency services after hours. Fault reports for municipal housing provider Härjegårdar were redirected to telephone and web-based forms. While core care services continued uninterrupted, full restoration of all systems remained ongoing with no confirmed completion timeline. The incident caused sustained operational limitations but no complete service outages in critical sectors like healthcare.