Estonia hit by 'most extensive' cyberattack since 2007 amid tensions with Russia over Ukraine war

·4-min read
Estonia hit by 'most extensive' cyberattack since 2007 amid tensions with Russia over Ukraine war

Estonia was subject to "the most extensive cyberattack" since 2007, the Baltic state’s government said on Thursday, a day after it started removing Soviet-era war monuments from public areas in the wake of Russia’s February invasion of Ukraine.

The Russia-based and pro-Russia hacker group Killnet said on the messaging app Telegram that it was responsible for Wednesday’s cyberattack and said that it blocked access to more than 200 state and private Estonian institutions.

"Yesterday, Estonia was subject to the most extensive cyberattacks it has faced since 2007," tweeted Luukas Ilves, under-secretary for digital transformation at Estonia's Ministry of Economic Affairs and Communications on Thursday.

However, he said the attacks went "largely unnoticed in Estonia" and despite “some brief and minor exceptions, websites remained fully available throughout the day".

The hackers used a DDoS attack, which is when a network is flooded with high volumes of data that it cannot handle and results in the network being paralysed.

"From the beginning of August the frequency of large-scale DDoS attacks against Estonian public authorities and businesses has increased," said Tõnu Tammer, executive director of the CERT-EE, an organisation responsible for the management of the country's security incidents.

We are also carefully monitoring whether any attempts are made to launch other attacks in the shadow of the DDoS attacks. We remain alert. We actively exchange information with domestic, as well as foreign partners.

Tammer told Euronews Next in a statement that 10 DDoS attacks happen in a month but in August there were more than 20.

He said the attack against the website of emta.ee (the Estonian Tax and Customs Board) on August 17 had the most visible effect, with the website being unavailable from 12.30 pm to 13.40.

"Based on what is known at this point, the attacks over the last few days were primarily targeted against the clients of the State Network of the Information System Authority. We have to keep in mind that such attacks may last several days and it is quite likely that some websites may not be immediately available at one point or another," Tammer added.

He did not say who was responsible for the attacks as "naming the group would give them attention which they do not deserve" but said they come from the cyber criminals known to the organisation since spring.

"We are also carefully monitoring whether any attempts are made to launch other attacks in the shadow of the DDoS attacks. We remain alert. We actively exchange information with domestic, as well as foreign partners," he added.

Strong defence infrastructure in Estonia

Despite Estonia being a small nation with a population of 1.3 million people, it has a strong cyber defence infrastructure that ranks third best in the world behind the United States and Saudi Arabia, according to the Global Cybersecurity Index (GCI).

Estonia, which neighbours Russia, beefed up its cybersecurity infrastructure after learning the lessons from the 2007 cyberattacks on the country, which lasted weeks and took out Estonian banks, government bodies and the media.

Estonia regained its independence in 1991 following the collapse of the Soviet Union.

The cyberattacks followed Estonia’s move to remove a Red Army monument from Tallinn square to the outskirts of the city as some saw it as a reminder of the Soviet occupation.

Protests were then triggered by false claims by Russian media that the statue and Soviet war graves were being destroyed by Estonia’s government. This was followed by two nights of riots by ethnic Russians and the historical cyberattack.

Exactly who was behind the attacks is unknown. The cyberattacks came from Russian IP addresses and the government has always denied any involvement.

"It has been called by many experts Web War One,” Ilves told Euronews Next in a recent interview. "It made us aware, maybe some years before the rest of the world, of the risks around cyber attack and cyber insecurity".

Digital Republic of Estonia

Cyber defence is a key priority for Estonia, not just due to the recent war in Ukraine, but because so much personal data is stored online.

Estonia is one of the leading digital nations and a large part of how the public interacts with the government is done digitally, from voting and paying taxes to setting up companies and verifying identity.

Estonia’s government on Tuesday ordered the removal of public Soviet memorials in the city of Narva, where 97 per cent of its population of about 60,000 people speak Russian.

An iconic T-34 tank in the city, which borders Russia, was taken down and relocated to the Estonian War Museum.

Estonia’s government said the Soviet memorials were being removed to prevent Russia from “mobilising more hostility" in the former Soviet-occupied country following Russia's February invasion of Ukraine.

Editor's note: An earlier version of this article referred to Estonia as being in the Balkans instead of in the Baltic region. The main image also depicted Venice and not Tallinn. We apologise unreservedly for these errors and have corrected them.