Cyber Incident Victim: Sweden Transport Agency
Date:
Oct 2017
Location:
Sweden
Summary
DDoS attacks disrupted Sweden's transport agencies on consecutive days, causing widespread train delays and system outages. The first incident halted or delayed trains by targeting IT systems managing orders, while also taking down email, websites, and road traffic maps, with some effects persisting. A subsequent attack the next day affected another agency and a public transport operator, disrupting services across multiple regions. The coordinated incidents appeared to probe the resilience of national transportation infrastructure, occurring amid heightened regional cyber activity tensions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 11, 2017, a distributed denial-of-service (DDoS) attack disrupted the Sweden Transport Administration (Trafikverket) during early morning hours. The attack targeted TDC and DGC, two service providers critical to Trafikverket’s operations, causing the failure of the IT system responsible for managing train orders. This forced the agency to halt or delay train services nationwide. Concurrently, Trafikverket’s email system and public website became inaccessible, preventing travelers from booking tickets or receiving real-time updates on disruptions. The agency resorted to Facebook to disseminate service restoration efforts and delay information to the public. Road traffic mapping systems also experienced outages, with partial functionality still impaired two days later. Trafikverket restored core services within hours, but residual delays persisted throughout the day due to cascading scheduling disruptions.
A second DDoS attack occurred on October 12, 2017, targeting the Sweden Transport Agency (Transportstyrelsen) and Västtrafik, a regional public transport operator managing trains, buses, ferries, and trams in western Sweden. The attack methodology mirrored the prior incident, overwhelming online systems and causing service interruptions. These sequential incidents suggested a coordinated effort to test response capabilities across Sweden’s transportation infrastructure. The attacks coincided with heightened regional tensions, following reports of Russian cyber activity in the Baltic Sea area the preceding week. Swedish authorities had previously attributed a November 2015 cyberattack on air traffic control systems to Russian actors, though no formal attribution was disclosed for the 2017 transport incidents. Operational impacts were confined to service delays and IT system downtime, with no reported physical safety incidents or long-term infrastructure damage.