Cyber Incident Victim: BankID
Date:
Apr 2025
Location:
Sweden
Summary
BankID experienced a severe overload attack causing a three-hour service disruption preventing legitimate users from accessing its systems. While the security of user data was not compromised, the attack significantly impacted an unknown number of users, with residual access issues persisting for some customers located overseas the following morning. The organization is investigating the incident and plans to file a police report while notifying relevant authorities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 23, 2025, BankID experienced a significant service disruption lasting approximately three hours. The cause was identified as a severe overload attack ("överbelastningsattack") targeting their systems. According to BankID's press spokesperson, Charlotte Pataky, the attack involved a massive influx of signals flooding the system, effectively preventing legitimate users from accessing the service. Pataky explicitly stated that this incident did not compromise the security of users' personal information or credentials. While the scale of the initial impact was acknowledged as affecting many users, BankID did not provide specific figures regarding the exact number of individuals disrupted during the three-hour attack window. The company expressed regret for the inconvenience and emphasized intense efforts to resolve the situation swiftly.
By the morning of April 24th, the immediate overload attack had subsided, but residual problems persisted for some users located outside Sweden. Pataky described the situation for international users as inconsistent, noting that the service worked for some but not for others. BankID continued working to fully resolve these lingering access issues. The organization declined to speculate publicly on the identity or motives of the attackers responsible for the overload attack. However, Pataky confirmed that BankID would pursue formal responses, including filing a police report and submitting incident reports to relevant authorities. Additionally, BankID committed to conducting its own internal investigation into the attack and the resulting service disruption.