hw_382e3d3e9ef10e2b

Cyberattack on Elron train-ticketing service caused by pro-Russia DDoS campaign.

During the afternoon of 20 September 2023, Estonia’s national rail-carrier Elron revealed that a wave of distributed denial-of-service (DDoS) attacks had shut down or severely degraded its ticket-purchase systems onboard, in-station and online. The service provider Ridango (ticket-system vendor) worked through the night with the Estonian State Information System Authority (RIA) to restore functionality. Estonia’s rail network is a key component of its civilian mobility, logistics backbone and links to defence-adjacent transport infrastructure; a national rail-system outage raises national-resilience concerns. The dynamics align with hybrid-warfare logic: a cyber-denial campaign that forces diversion of operational resources, imposes disruption costs, triggers contingency procedures and signals that Estonia’s critical-services layer is vulnerable to state-linked hostile actors. Estonian authorities described the perpetrators as “supporters of the aggressor state” (i.e., aligned with Russia) and warned of repeated campaigns targeting the transport, energy and digital-services sectors. The incident fed into Estonia’s broader threat-assessment for 2023–24, spurring increased investment in DDoS-mitigation, supply-chain cyber-resilience and national contingency planning for transport-infrastructure compromise.

Occurrence

2023-09-20

Publication

2023-09-19T22:00:00Z

First observed

2026-09-24T06:09:10.079Z

Review status

Not assessed

Countries

EE

Updated

2026-09-27T23:56:59.668Z