‘Crisis situation’ declared as two Swedish municipalities hit by cyberattack

A ‘crisis situation’ has been declared across the Swedish municipalities of Borgholm and Mörbylånga after a cyberattack was discovered late on Monday.

An intrusion has been confirmed into the joint IT system used by the two municipalities, which together make up the island of Öland with a total population of just over 25,000.

Working overnight, staff have disconnected both of the districts’ official systems from the internet as a precaution, and “external actors” have been brought in as part of the councils’ incident management response, said Borgholm’s municipal manager Jens Odevall

While Mörbylånga's website is unavailable, Borgholm is hosted by an external provider and is still accessible. However a range of citizen services provided by both municipalities are now unavailable, including email and some healthcare services. Healthcare providers in the area have reverted to using pen and paper, which Odevall said is something there are routines in place for.

The nature of the incident has not yet been disclosed, but it follows a number of ransomware attacks targeting European municipalities, including the Belgian city of Antwerp.

Odevall told the Ölandsbladet newspaper that he had been in contact with Sweden’s state authorities about the incident.

Asked if it was an extortion attempt or sabotage, he said: “It's a little too early to say, we don't know the details. But traffic has been seen and that data has been downloaded, but at the moment we don't know what kind of data it is.”

He warned it could take several days for the councils’ systems to be working again, and that municipal companies are likely to be affected.

The website for Bornholm Energi, which delivers a range of infrastructure services including “producing and delivering water, electricity, heat” and “household waste and sewage,” currently warns: “Due to Monday's IT attack, as a security measure we have shut down our IT systems, which means that it is currently not possible to reach us via e-mail and that we have limited availability via telephone.”

A spokesperson for the company was unable to clarify what impact the attack will have on the provision of these services.