Article
Industries Cybercriminals Target and Why They Are Exposed
Cybercriminals target healthcare, finance, retail, government, manufacturing and energy. See why these industries are exposed and how to cut the risk.
Read more
Significant cyber incident
Attack on Spain’s public employment service (SEPE), March 2021
Spain's State Public Employment Service (SEPE) suffered a security incident on 9 March 2021 that interrupted the availability of its information and communications systems.
In short
Spain's State Public Employment Service (SEPE) suffered a security incident on 9 March 2021 that interrupted the availability of its information and communications systems. SEPE is the state body behind unemployment benefits and job services. INCIBE-CERT and the Government said no data was stolen and benefits were paid on time. Press coverage, linked from INCIBE-CERT, named Ryuk ransomware; the official texts opened do not name the malware.
What happened
On 9 March 2021 the State Public Employment Service (SEPE) suffered a security incident. SEPE is an autonomous body attached to Spain’s Ministry of Labour and Social Economy. The incident interrupted the availability of its information and communications systems.
INCIBE-CERT, Spain’s national response team for citizens and businesses, published a note on 16 March 2021. It said the web portal had been available again since 12 March and that the other services for citizens, companies, benefit offices and employment would be restored gradually through the month.
The official texts opened call it a “security incident” and, in INCIBE-CERT’s note, a cyberattack. They do not name the malware. The INCIBE-CERT page links to a press article headlined “Ryuk ransomware hits 700 Spanish government labor agency offices”. That is press coverage and is not confirmed in the official texts opened.
The authorities said no data was stolen and that benefit payments were not delayed. The Government repeated this in a written answer to Congress dated 31 May 2021.
Timeline
-
9 March 2021
SEPE suffers a security incident that interrupts the availability of its information and communications systems.
-
9 March 2021
The response is immediate, to isolate the incident and limit its impact (INCIBE-CERT).
-
12 March 2021
The SEPE web portal is available again.
-
16 March 2021
INCIBE-CERT publishes its note. The CCN, SEPE and the General Secretariat for Digital Administration are still working to find the origin and effects.
-
March 2021
Other services for citizens, companies, benefit offices and employment are to be restored gradually through the month.
-
Until full restoration
Application deadlines are not counted until the management system is fully restored.
-
31 May 2021
The Government answers a written question in Congress: the whole computer estate is reactivated, data was safeguarded and benefit payments were not delayed.
How the attack worked
What the official texts say
The official texts opened give no account of how the attackers got in, which tools they used or what they wanted. INCIBE-CERT says the origin and effects of the incident were still being worked out by the National Cryptologic Center (CCN), SEPE and the General Secretariat for Digital Administration on 16 March 2021. The Government’s answer of 31 May 2021 does not describe the method either.
What is only reported by the press
INCIBE-CERT’s page links to a press article headlined “Ryuk ransomware hits 700 Spanish government labor agency offices”. Ransomware locks systems to demand payment. We could not open the press article, so we make no claim about the attack chain, the number of offices or any ransom demand.
How the response was organized
Spain’s current National Security Framework (Royal Decree 311/2022, adopted a year after this incident) says the CCN organizes incident response around CCN-CERT, and that after an incident CCN-CERT technically determines the risk of reconnecting the affected systems. In SEPE’s case the Government says restoration was supervised by the CCN, in coordination with the General Secretariat for Digital Administration.
Who says who was behind it
No public attribution in the official texts opened. INCIBE-CERT (16 March 2021) and the Government's written answer (31 May 2021) name no attacker and no malware. A press article linked from INCIBE-CERT's page is headlined as a Ryuk ransomware attack; this is not an attribution by an official body.
Impact
INCIBE-CERT, 16 March 2021: SEPE's information and communications systems were interrupted. It says no data was stolen, the confidentiality of benefit payments was not affected, and SEPE's operating and management systems and servers were not damaged.
The web portal was available again from 12 March 2021. Other services were to be restored gradually through March 2021.
Government answer to Congress, 31 May 2021: the protection of users' data was safeguarded; benefit application deadlines were extended by as many days as the applications were out of service; the incident caused no delay in benefit payments, which were made at the usual pace.
The number of offices, appointments or people affected is given in the press but not in the official texts opened, so we do not state it.
Government and regulator response
- 9 March 2021: SEPE acted at once to isolate the incident and limit its impact (INCIBE-CERT).
- 12 March 2021: the SEPE web portal was available again.
- 16 March 2021: INCIBE-CERT reported that the CCN, SEPE and the General Secretariat for Digital Administration were working to find the origin and effects, and that SEPE would not count application deadlines until the management system was fully restored.
- 31 May 2021: in a written answer to Congress the Government said the systems were restored step by step under CCN supervision, the whole computer estate was reactivated, and deadlines were extended by the days of outage.
Statements by the Minister of Labour were not opened for this profile.
Lessons
-
Tell people their rights are safe, fast
SEPE said application deadlines would not be counted until the system was restored, and the Government later said deadlines were extended by the days of outage. Clear rules for citizens limit the harm of an outage.
-
Public bodies need a named incident lead
Spain's current National Security Framework has the CCN organize the response through CCN-CERT. In this case the CCN supervised the restoration with the General Secretariat for Digital Administration.
-
Restore step by step
The web portal came back on 12 March, three days after the incident, and other services followed through the month. Plan an order of restoration before you need it.
-
Separate payments from front-end systems
The Government said benefit payments were made at the usual pace. Keep the payment chain able to run when public-facing systems are down.
-
Do not name the malware before you know
The official texts opened name no malware. Only press coverage did. Wait for confirmation before you tell your own staff what hit you.
What to check in your own organization
-
Manual fallback
Write down how your front-line staff serve people for several days if every system is down, and test it once a year.
-
Restoration order
List which services come back first, who decides, and who checks that a system is safe to reconnect.
-
Payments and legal deadlines
Check whether an outage would stop payments or make people miss legal deadlines, and who can pause the deadlines.
-
Incident lead
Name the national or sector team you call first (for Spanish public bodies, CCN-CERT) and keep the contact details offline.
-
Backups
Confirm that backups sit outside the normal network and that you have restored from them recently.
-
Public statements
Prepare a short holding statement that says what is affected, what is not, and when the next update comes.
Where it happened
Questions
What happened to Spain's employment service in March 2021?
On 9 March 2021 SEPE suffered a security incident that interrupted the availability of its information and communications systems. The web portal was back on 12 March 2021 (INCIBE-CERT).
Was it ransomware?
The official texts opened say "security incident" and "cyberattack" and do not name ransomware. A press article linked from INCIBE-CERT's page was headlined as a Ryuk ransomware attack. We treat that as press coverage only.
Was personal data stolen?
INCIBE-CERT says it was confirmed that no data was stolen. The Government told Congress that the protection of users' data was safeguarded.
Were unemployment benefits paid?
The Government's written answer of 31 May 2021 says there were no delays in benefit payments, which were made at the usual pace.
Who handled the response?
INCIBE-CERT says the CCN, SEPE and the General Secretariat for Digital Administration worked together. The Government says restoration was supervised by the CCN.
Who was behind it?
No public attribution in the official texts opened.
In our research
Sources
- SEPE begins to recover its services after suffering a cyberattack INCIBE-CERT
- Respuesta del Gobierno, pregunta escrita 184/47960 (SEPE security incident) Congress of Deputies, Government of Spain
- Real Decreto 311/2022, por el que se regula el Esquema Nacional de Seguridad Boletin Oficial del Estado
- Data Encrypted for Impact, Technique T1486 - Enterprise MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.