Cyber Incident Victim: Ministry of Energy and Natural Resources
Date:
Dec 2016
Location:
Turkey
Summary
A major cyber-attack targeting the Turkish Energy Ministry was reported, with sources attributing widespread electricity outages in Istanbul to infiltration attempts on systems controlling transmission and production lines. The attacks, described as preparations for large-scale sabotage against the national electricity network, prompted a comprehensive investigation involving police cooperation to assess damage. While initial infrastructure failures were linked to severe weather damaging transmission towers, authorities emphasized examining all potential causes for the outages affecting industrial regions and millions of residents. Security measures were heightened following intelligence warnings about possible cyber-attacks, with ongoing repair efforts and no further major disruptions reported after the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late December 2016, Turkish Energy Ministry sources reported a major cyber-attack targeting critical infrastructure systems controlling electricity transmission and production lines. The attacks, described as infiltration attempts aimed at seizing control of internet-connected operational systems, were linked to widespread power outages affecting Istanbul and surrounding industrial regions. A senior anonymous ministry official stated these incidents indicated preparations for large-scale sabotage against Turkey’s national electricity grid, with activity intensifying following the failed July 15 coup attempt earlier that year. Intelligence units had reportedly received warnings of planned cyber-attacks coinciding with New Year’s Eve. Initial system compromises were detected and prevented, though physical damage to seven main transmission lines on December 29 exacerbated the crisis. Energy Minister Berat Albayrak confirmed a comprehensive investigation into whether cyber intrusions contributed to the destruction of recently upgraded infrastructure in Kocaeli province, the epicenter of the outages affecting millions during sub-zero temperatures.
The incident caused severe disruptions across Istanbul’s 14 million residents and industrial zones spanning Kocaeli to Istanbul, with rolling blackouts continuing through December 31. Ministry response teams deployed 164 personnel across four repair groups to address physical damage to transmission towers attributed primarily to heavy snowfall and storms in the Marmara region. Concurrently, cybersecurity coordination with national police focused on assessing digital system compromises and mitigating further attacks. While the ministry emphasized weather-related causes for the infrastructure damage, officials acknowledged examining all potential contributing factors, including cyber sabotage. Repair efforts restored full electricity service by January 1, though the investigation into cyber-attack vectors and perpetrator attribution remained ongoing at the time of reporting.