Skip to content
HackIT
Talk to a tester

Estonia's cyber month: October 2026

What RIA reported for October 2026: 837 incidents, e-service outages, data leaks, critical PHP and GitLab flaws and fake LinkedIn job offers for developers.

HackIT Security Team

Monthly review cover: Estonia's cyber month: October 2026

In short: RIA registered 837 cyber incidents with impact in Estonia in October 2026, fewer than its average for the last six months. The month brought outages of state e-services and of a European Commission service that digital signing depends on, two data leaks through flaws in an API and in third-party software, and critical PHP and GitLab flaws that RIA says should be patched as soon as possible. RIA also warned that fake LinkedIn job offers are being used to get software developers to run malware.

What RIA reported

The numbers. RIA counted 837 incidents with impact in October, meaning incidents reported to CERT-EE that affected the confidentiality, integrity or availability of data or systems, against 964 in September, according to its monthly report. Phishing sites make up most of the incidents CERT-EE records: 453 in October, after 628 in September.

E-service disruptions. The state authentication service GovSSO had faults on 1 October between 12.25 and 13.45, after repeated faults in September; RIA says the causes differed, one a DDoS attack and the others technical problems. Services run by SMIT, the Ministry of the Interior's IT centre, were disrupted twice: on 6 October, a temporary instability in Interpol's services affected border checkpoints and stopped police patrols from checking vehicle number plates, and on 13 October a data-centre fault disrupted nearly 26 services. On 21 October, the European Commission's List of Trusted Lists was unavailable between 00.22 and 11.09, which caused problems with, among other things, digital signing, the health information system, the Delta document system, one bank and other companies. RIA gives no cause for that outage.

Data leaks. A company that provides booking software to accommodation providers found on 8 October that the names, phone numbers, email addresses and booking details of about 9,000 customers had leaked through a flaw in an application programming interface (API), since fixed. A classifieds portal leaked the personal data of up to 5,000 users through a flaw in third-party software, which it has stopped using. RIA names neither company. RIA's report also covers an attack on Dodo Pizza, which operates in Estonia, on 27 and 28 September: up to 68 million customers' data may have leaked. Dodo Pizza says the attackers mainly reached Russian customers' data, while the group that claimed the attack says its database includes about 256,000 Estonian customers.

Critical flaws. On 21 October, fixes were published for two critical PHP flaws that let an attacker run commands without logging in, and for a critical GitLab flaw that could let an attacker without an account take over the server. "We recommend installing the relevant security updates as soon as possible," said Dorel Kiik, an analyst at RIA, in its summary.

Fake job offers. RIA warned about fake LinkedIn job offers aimed mainly at software developers. In one case, a person who downloaded a booby-trapped software project during a fake interview lost control of a cryptocurrency wallet holding nearly $10,000. RIA's analysis found that the technical features of a recent Estonian case overlapped with a campaign linked to North Korean state cyber criminals.

What it means for companies

  1. Your APIs and suppliers are part of your attack surface. The two October leaks RIA describes came through a flaw in an API and a flaw in third-party software.
  2. Developers are targets in their own right. The fake job offers aim at them, and RIA says GitLab servers may hold an organisation's source code and access credentials.
  3. Outside services can disrupt yours. One European Commission list, unavailable for almost eleven hours on 21 October, was enough to disrupt digital signing and other Estonian e-services.

What to check this month

  1. Patch PHP and GitLab. RIA says the GitLab update should not be postponed. For PHP's fixed versions and how to check a server, see our post on PHP2Shell.
  2. Brief your developers. RIA advises checking that a job offer exists on the company's official website, and running an unknown project from an interview only in a separate test environment, such as a virtual machine, holding no passwords, keys or other sensitive data.
  3. Review the APIs that return customer data. A flaw in one is what exposed about 9,000 booking customers. A web application penetration test covers an application's API as well as its pages.
  4. Report fraudulent websites to CERT-EE at cert@cert.ee, as RIA's campaign, running until 8 November, asks.

If you want to know how your APIs would hold up, talk to a tester.

Sources

All posts