Danish Ministry of Defence

Summary

The Danish Ministry of Defence experienced a distributed denial-of-service (DDoS) attack that overloaded its web servers, initially misattributed to technical issues. The attack disrupted access to its web portals but did not affect operational capabilities. The organization's IT unit worked to mitigate the external traffic overload, confirming no additional compromises beyond the temporary service unavailability.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 8, 2022, the Danish Ministry of Defence (Forsvarsministeriet) experienced a disruption affecting its web services, initially assessed as a technical issue. Subsequent analysis revealed the incident to be a distributed denial-of-service (DDoS) attack targeting backend web servers. The attack deliberately overloaded systems to the point where they could no longer respond to legitimate requests or display standard web content. This resulted in widespread accessibility issues across the ministry's web portals, though the exact duration of the outage wasn't specified in public statements. No initial evidence suggested data breaches or system compromises beyond the service unavailability.

Forsvarets Koncern IT, the defence IT organization, immediately initiated response measures to mitigate the external traffic overload causing the disruption. Their efforts focused on identifying and blocking malicious traffic sources to restore normal operations. The ministry confirmed the attack exclusively impacted web portal accessibility, with no cascading effects on defence operations, critical infrastructure, or classified systems. No threat actor attribution or motive was disclosed. Final assessments maintained that the incident's consequences were strictly limited to temporary service degradation without operational or security compromises beyond the denial-of-service condition.

Sources

Sources available to members: 1 source.