Estonia’s Information System Authority (RIA) recorded 899 cyber incidents with impact in August. Its overview covers outages, a ransomware attack and phishing. For a small business, the most useful lesson is a campaign of fake parking fine texts sent in the Transport Administration’s name.
What happened in August?
The fake fine campaign used text messages. They claimed the recipient had parked in a paid zone and been fined. The link in the message led to a phishing site, a fake page imitating an official service, designed to get into the victim’s bank account.
On 28 August a school in Harju County was hit by ransomware. The attackers encrypted its file server, print server and domain controller, the server that manages user accounts and access. RIA says the main services have been restored and the details are still being established.
Was every outage an attack?
No. Several services went down in August, and in several cases the cause was a technical fault or a configuration error. On 4 August the automatic border gates at Tallinn Airport stopped working. Swedbank customers had problems with payments and logging in to online banking. A configuration error left Pärnu Hospital’s IT services unavailable for about an hour. GovSSO, the state single sign-on service, also had failures.
“The incidents in August illustrate that not every disruption to a digital service is necessarily the result of a cyberattack,” said Dorel Kiik, an analyst at RIA. For the user, he added, the impact may be the same: the service they need is unavailable for some time.
For a business, that means planning for outages whatever their cause. It is worth knowing whether payments, invoicing and customer contact can carry on for a few hours without your bank or a state e-service.
How do you spot a fake fine text?
The channel gives it away. “Neither the police nor the Transport Administration send notices of fines by text messages,” Kiik said.
Treat any unexpected message with suspicion if it demands quick action and asks you to enter bank or card details through a link. RIA advises checking whether a demand is genuine on the official website or through another channel you trust. In practice, type the address yourself rather than tapping the link.
Why should a business care?
A scam text does not care whether a phone is used for work or at home. If an employee enters a company card or bank login on a scam page, the business carries the loss. The same trick works in the name of any authority or supplier; only the sender’s name changes.
The school attack shows that a school or a small office is not too small a target for ransomware. File servers and domain controllers sit in many small offices too. Kiik said educational institutions “should therefore take a critical look at the security, backups, and updates of their systems”. That advice applies just as well to a ten-person company.
What to do now
- Brief your staff on fake fine texts. Tell them plainly that the police and the Transport Administration do not send fines by text, and that any message rushing them to pay deserves a second look.
- Agree how demands are checked. Staff open the authority’s website themselves or call its official number, never the number in the message.
- Act at once if someone has entered details. Contact the bank to block the card or access. Phishing pages can be reported to CERT-EE at cert@cert.ee.
- Test your backups. Keep at least one copy offline and check now and then that you can actually restore from it.
- Ask your IT partner to keep servers and computers updated. Unpatched systems are among the easiest ways in for ransomware.
If you think an attacker is already inside your systems, see our incident help page.
Sources
- RIA: August in cyberspace: service disruptions, ransomware attacks and phishing messages
- RIA: August küberruumis: teenusetõrked, lunavararünne ja õngitsussõnumid
- RIA: Olukord küberruumis – august 2026
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
