Cyber Incident Victim: Árvakur hf
Date:
Feb 2024
Location:
Iceland
Summary
A cyberattack targeted the media outlet's website in the late afternoon, causing several minutes of downtime. The incident, identified as a stress attack (likely DDoS), disrupted web services but was swiftly mitigated by technical teams, restoring normal operations promptly. Such attacks are noted to be increasingly frequent.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 8, 2024, at approximately 17:15 local time, the Icelandic news outlet Morgunblaðið (mbl.is) experienced a cyberattack targeting its web services. The incident caused the website to become unavailable for several minutes, disrupting access for users attempting to reach the platform during this period. Technical staff from Árvakur, the media company responsible for Morgunblaðið's operations, immediately responded to the outage upon detection. Initial analysis confirmed the attack constituted a stress attack, a type of assault designed to overwhelm web infrastructure with excessive traffic or resource demands. The disruption remained confined to the website's availability, with no reported compromise of internal systems, user data, or secondary platforms under Árvakur's management during this event.
Árvakur's technicians successfully restored full functionality to mbl.is within a short timeframe following the initial disruption, implementing measures to secure the website against further instability. The rapid response ensured normal operations resumed without prolonged service degradation or additional downtime. No collateral impact on other Árvakur-associated entities, such as radio station K100, was documented in available reports. Both Árvakur and Morgunblaðið characterized the incident as part of an escalating trend of similar cyberattacks, noting the increasing frequency of such events targeting online services. The organization did not disclose technical specifics regarding attack vectors, mitigation strategies, or potential attribution in publicly available statements following the restoration of services.