Cyber Incident Victim: Georgian government agencies
Date:
Oct 2019
Location:
Georgia
Summary
A large-scale cyber-attack targeted multiple entities in Georgia, temporarily disrupting two television broadcasters and defacing or taking offline approximately 15,000 websites hosted by a major provider. The compromised sites spanned government agencies, media outlets, and private businesses, with defaced pages displaying images of a former president and a banner referencing his return. Critical national infrastructure was unaffected, and authorities initiated an investigation into the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 28, 2019, a large-scale cyber-attack commenced against targets in Georgia, resulting in significant disruption. The attack temporarily took two Georgian television broadcasters, Imedi TV and Maestro, offline. Concurrently, thousands of websites were defaced and subsequently taken offline, including personal sites, business pages, local newspaper sites, and official government webpages such as those for the general jurisdiction courts and the office of President Salome Zurabishvili. The defacement involved replacing home pages with images of former President Mikheil Saakashvili and a banner stating "I'll be back." A primary target was identified as the Proservice web hosting provider; the company reported that its server, which housed websites for state agencies, the private sector, and media organizations, was attacked, causing approximately 15,000 subscriber websites to crash. Proservice issued a statement confirming it was repelling what it called one of the largest cyber-attacks on Georgia's cyber space, which began at dawn on October 28.
The immediate impact was the widespread unavailability of numerous websites and the interruption of television broadcasting, though the article specifies that critical national infrastructure was not affected. Proservice, in collaboration with the Ministry of Internal Affairs and leading cybersecurity experts, initiated a restoration process. By 8:00 PM on October 28, the company reported that more than 50% of the web pages hosted on its affected servers had been restored. The company stated that work would continue throughout the night with the aim of fully restoring all web pages by the end of the following day. Georgia's interior ministry confirmed it had begun an official investigation into the attack to determine its origins and full scope, while the incident prompted observations about the vulnerability of digital infrastructure to politically motivated disruptions.