Cyber Incident Victim: Městská část Praha 5
Date:
Mar 2022
Location:
Czechia
Summary
Městská část Praha 5 experienced a cyber attack causing significant operational disruptions, with municipal office services temporarily limited. Computer-dependent requests became unprocessable, though phone lines were later restored enabling communication via fixed lines and an information hotline. Partial service resumption included issuing pre-prepared travel documents and identity cards, while new applications required submission at alternate municipal offices. Recovery efforts prioritized restoring critical functions, with updates provided through official data boxes and the office website as work continued to fully reinstate affected systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around March 21, 2022, Městská část Praha 5 (MČ Praha 5) experienced a cyberattack that disrupted normal operations of its municipal office (ÚMČ Praha 5). The attack necessitated immediate technical and security measures, leading to temporary restrictions across departmental services. Computer-dependent processes became unavailable, preventing the fulfillment of requests requiring technological infrastructure. By the morning of March 21, limited functionality resumed for the Department of Personal Documents and Population Registry, allowing the issuance of pre-processed travel passports and identity cards. However, new applications for these documents remained impossible, forcing citizens to submit requests at other Prague municipal offices (districts 1-22) or authorized municipalities nationwide. Telephone communications were restored by 14:04 on March 21, reactivating the central information line (257 000 111) and fixed-line departmental contacts, while provisional mobile numbers previously advertised were decommissioned.
The municipal office operated under restricted capacity throughout March 21 as teams worked to mitigate the attack’s consequences. Data box communication remained operational for electronic correspondence, and the office maintained public updates via its website regarding available services. A dedicated webpage listed currently functional activities and contact points, with commitments to promptly announce further service restorations. Critical limitations persisted, including the inability to process new document applications internally. The disruption caused significant inconvenience to citizens, acknowledged by the administration through public apologies. Recovery efforts focused on incremental restoration of prioritized services while addressing security vulnerabilities from the attack.