Czech Republic

Summary

A cyberattack involving a massive DDoS incident disrupted a national tax portal, rendering it inaccessible by overwhelming the system with traffic. The attack occurred amid broader increases in such incidents, with security agencies noting a significant portion originating from Russia in connection to regional geopolitical tensions. Service disruptions prompted authorities to extend the electronic tax filing deadline, alleviating potential penalties for late submissions faced by self-employed individuals mandated to file digitally. The incident underscores operational vulnerabilities to common DDoS tactics while highlighting immediate administrative adaptations to maintain compliance timelines under duress.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 1, 2024, the Czech Financial Administration reported a disruptive cyber incident targeting its Tax Portal, which handles electronic income tax filings. Attackers executed a massive Distributed Denial of Service (DDoS) attack, overwhelming the system with excessive traffic that rendered it inaccessible to legitimate users. This disruption occurred during a critical period when self-employed individuals faced mandatory electronic submission deadlines. The Financial Administration responded by extending the original May 2 deadline for tax advisor-assisted filings to July 9, providing affected taxpayers with additional time to comply. Failure to meet deadlines carried financial penalties of 0.05% of assessed tax per day of delay, underscoring the operational significance of the portal's availability.

The incident reflects broader cybersecurity trends, with DDoS attacks identified as increasingly prevalent—particularly following geopolitical tensions surrounding Russia's invasion of Ukraine. While security authorities noted many recent attacks originate from Russian-affiliated actors, no specific attribution was provided for this incident. Service restoration timelines and technical mitigation measures were not disclosed in available reports. The deadline extension constituted the primary documented response measure, directly addressing the attack's immediate impact on taxpayer compliance obligations. Financial penalties for late submissions remained enforceable despite the portal's temporary inaccessibility.

Sources

Sources available to members: 1 source.