A 16 December cyber attack, believed to have been orchestrated by “multiple state-backed” hackers from China, cost the Belgian Ministry of Defence €2.25 million in direct costs, Defence Minister Ludivine Dedonder has admitted on Wednesday.
Almost a year later, “all systems are operational again, with the exception of video conferences with external pirates via the Internet (Skype or Vidyo),” Dedonder said in response to a written question from N-VA politician Micahel Freilich, which was later published in La Libre Belgique.
Hackers exploited a major security vulnerability (Log4Shell) within Apache’s Log4j software, which paralysed the capabilities of the Defence Ministry. The ministry suffered significant damage to its network as a result. Its network was cut off from the internet for weeks and email traffic with the outside world was disrupted.
Staff were forced to rely on highly vulnerable communications, such as WhatsApp and other IM software, to get their work done. In mid-January, staff were still unable to access much of their digital technology.
The same Chinese hackers were credited with an attack against FPS Interior.
“In total, to date, it has cost the Defence Ministry 2.25 million in direct costs (material, personnel, and services),” the minister said. The ministry declined to use any new subcontractors or licensed companies to fix issues within its systems.
“No contracts were signed with new companies, existing contracts were used. Specifically, we requested additional services from Microsoft, Nippon Telegraph and Telephone Corporation (NTT), and Mobco SRL,” Dedonder specified.
Related News
- Controversy as Belgian Defence uses Chinese appliances to access the internet
- Belgian military's 'Cyber Command' to be operational in 2024
- Ransomware group threatens to publish Vivalia patient data
Fixing the network utilised significant resources at the ministry. By the end of August, repairs used-up 12,000 man-hours of work, as well as 3,735 man-hours by private companies.
Despite blame falling clearly at the feet of Chinese hackers, and possibly the Chinese government, the Defence Ministry said that it does not intend to recover the costs from the accused parties.
