The most serious major incident handled by the NÚKIB was the encrypting of the University Hospital Brno systems using ransomware in March 2020.iii The incident led to significant limitations on the hospital’s operation at three localities and caused damage in the millions of crowns.iv The Psychiatric Hospital in Kosmonosy became a ransomware victim in the same month.v In that case, mainly the administrative infrastructure of the hospital was paralyzed but its ability to provide healthcare was not compromised, nor were any systems on which human lives depend affected.vi CYBER INCIDENTS IN 2020 BY INCIDENT TYPE The descriptions of the categories are based on the options in the incident reporting forms: 37 26 The third major incident5 of 2020 was the compromising of several dozen e-mail accounts of a strategic gov­ ernment institution, which occurred as a result of a successful spear-phishing campaign. Besides a breach of confidentiality of the content of the mailboxes, the compromise also caused the e-mail services to be un­ available for a day or two. 16 More than one-third of the incidents handled by the NÚKIB were caused by malicious code, nearly half of which through ransomware. Another almost one-third of incidents resulted in limited availability of services, systems or web portals, half of which were caused by DDoS attacks. 7 7 3 1 2 MALICIOUS CODE (e.g. viruses, worms, Trojan horses, dialers, or spyware) AVAILABILITY (e.g. disruption of availability caused by a DoS/DDoS attack or sabotage) PENETRATION (e.g. successful compromising of an application or a user account) FRAUD/PHISHING (e.g. e-mail with a malicious attachment or link) PENETRATION ATTEMPT (e.g. attempt to exploit a vulnerability, compromised asset, zero day attack) INFORMATION GATHERING (e.g. scanning, sniffing, or social engineering) ABUSIVE CONTENT (e.g. spam, cyberbullying, inappropriate content) ADMINISTRATIVE/TECHNICAL (a security incident caused by administrative or technical fault) 5 The incident severity assessment is based on Decree No 5 The incident severity assessment is based on Decree No 82/2018 82/2018 Cyber Security in 2020 from the Perspective of Cyber Czech Incidents Institutions, fromOrganisations, the Perspective and ofCompanies the NÚKIB 14