Cyber Incident Victim: Ощадбанк
Date:
Feb 2022
Location:
Ukraine
Summary
Sberbank experienced a DDoS attack targeting its online banking systems, resulting in temporary slowdowns for customers accessing services. The institution confirmed all systems remained secure and operational despite increased communication channel loads, with efforts underway to restore normal functionality and minimize user disruptions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 15, 2022, Oschadbank (Sberbank) publicly disclosed it was experiencing a distributed denial-of-service (DDoS) attack targeting its digital infrastructure. The attack generated excessive traffic that overwhelmed communication channels, resulting in observable slowdowns for customers attempting to access the Oschad24/7 online banking system. The bank confirmed all core banking systems remained operational and secure despite the incident, with no reported compromise of customer data or financial assets. Service degradation was confined to delays during login attempts to the digital platform, with no indication of broader system outages affecting transactions, account access, or other critical banking functions. Oschadbank's technical teams immediately initiated response protocols to mitigate the attack's impact on connectivity.
The bank issued a formal apology for temporary inconveniences caused by the reduced system responsiveness, emphasizing ongoing efforts to fully restore standard operational speeds. No specifics regarding attack duration, traffic volume, attacker identity, or motivation were disclosed in the public statement. Oschadbank maintained transparency by promptly notifying customers of the incident through its official news channel while reiterating the integrity of its security measures. Operational updates focused solely on resolving the performance issues attributed to the abnormal network load, with no subsequent reports of escalated disruptions or secondary incidents linked to the DDoS activity. The incident concluded with service normalization following the mitigation of malicious traffic.