September in cyberspace: data breaches and disruptions to state e-services

In September, patient data, including health data, was reported to have been unlawfully downloaded from a computer system managed by Innovaatik. Attackers accessed the University of Tartu’s e-bookstore, most likely through an unpatched vulnerability, and customer data may have been downloaded. Estonian websites and the national authentication service were targeted by denial-of-service attacks. In addition, a configuration error during planned maintenance and other causes still under investigation disrupted state e-services.