Scoping Estonia’s Public-Sector Attack Surface After September’s DDoS Wave
In September 2026, Estonia’s state information system authority, the Riigi Infosüsteemi Amet (RIA), recorded 964 cyber incidents with an impact. Among them were distributed denial-of-service attacks against the websites of banking, healthcare, energy, transport and water organisations, government agencies and political parties. A separate burst hit the national authentication service with more than 86 million requests, over a hundred times the normal load.
That summary is short. The work it implies is not. When availability incidents arrive in clusters, the first useful question is not who did it but what is actually reachable from outside. An incident report tells you what was attacked. It rarely tells you how much of your organisation was visible in the first place.
The problem with incident-led inventory
Most teams learn the shape of their external estate during the incident. A service goes down, engineers trace it, and someone discovers that a forgotten hostname still resolves, that a test instance shares a production certificate, or that a partner portal sits on infrastructure nobody has reviewed in two years.
September’s Estonian incidents fit that pattern. The reported targets span sectors that share very little infrastructure but a great deal of public exposure. Websites for health, energy and transport organisations are not one system. They are many, operated by different bodies, with different maintenance cycles and different tolerances for downtime.
Scoping that estate is a measurement problem before it is a defence problem. You cannot prioritise what you have not enumerated.
What an external measurement shows
A cyberspace search engine such as ZoomEye indexes internet-visible assets: hosts, services, certificates, banners and page titles. Querying by country and industry gives a rough, reproducible picture of how much public-sector infrastructure is externally observable.
For Estonia, a query for government-industry assets returns 263 matching observations.
country="EE" && industry="government"
Exposure: 263 matching assets (ZoomEye, 2026-10-14 UTC, sub_type=all)
That figure is a count of indexed matches, not a list of victims. It says nothing about whether any of those assets was attacked, vulnerable or misconfigured. What it does say is that the country’s government-sector footprint is large enough to be enumerated externally, and small enough to be reviewed deliberately.
Broadening the lens makes the scale clearer. Estonian domain assets serving HTTPS return 21,335 observations. Assets answering on port 443, including hosts without a matching domain record, return 135,740.
country="EE" && service="https" && is_domain=true
Exposure: 21,335 domain assets
country="EE" && port="443"
Exposure: 135,740 assets
The gap between those two numbers is itself informative. A large share of externally visible Estonian TLS endpoints are not tied to a discoverable domain. Those are the assets that tend to be missing from internal inventories, because inventories are usually built from domain and certificate records.
Turning a count into a worklist
A count is only the first step. The useful output of an external measurement is a comparison: what is visible outside against what is known inside.
For a public-sector organisation, that comparison usually surfaces three categories of asset. The first is expected and documented — the services the organisation knows about and maintains. The second is expected but undocumented — systems that exist in spreadsheets rather than in configuration management. The third is unexpected, and this is where measurement earns its place: hosts that resolve, respond, and have no owner.
The third category deserves priority, not because it is necessarily vulnerable, but because it cannot be defended by process. No patch cycle covers a host nobody knows exists.
Practical scoping steps
A defensible external scoping exercise for a public-sector body looks roughly like this.
Fix the scope. Choose the country, industry, organisation or ASN boundaries you can justify, and record them. A query without a recorded scope cannot be repeated or audited.
Capture the baseline once. Record the query, the date and the count. The value of a baseline comes from comparison, not from the first reading.
Attribute every match. For each externally visible asset, identify an internal owner. Unattributed assets move to the top of the worklist.
Separate exposure from vulnerability. An observable host is not a compromised host. Keep the two questions distinct or the worklist becomes unusable.
Re-measure on a schedule. Monthly comparison catches new hosts faster than annual audits.
Reading the September numbers honestly
The temptation after a DDoS wave is to treat every number as evidence of weakness. The 86 million requests against the national authentication service is a measure of attack volume, not of defensive failure; RIA reported that the service continued to function with short delays. The 263 government-industry matches are a measure of visibility, not of exposure to that specific attack.
What the numbers do support is a narrower and more useful claim. Estonia maintains a substantial, externally observable public-sector attack surface, and the September incidents show that parts of it are attractive targets. That combination is enough to justify routine external measurement as part of operational hygiene, without overstating what any single figure proves.
Where ZoomEye fits
ZoomEye is built for this kind of enumeration. It indexes asset attributes that matter for scoping — country, industry, service, port, certificate content and page titles — and it returns counts that can be compared over time.
For an organisation that has just been through an availability incident, that capability translates into a concrete question: which of the assets visible today were visible last month, and which of them have an owner?
Answering that is not a substitute for incident response. It is the groundwork that makes the next response faster.
References
- Riigi Infosüsteemi Amet, “September küberruumis: andmelekked ja häired riigi e-teenustes”, https://ria.ee/uudised/september-kuberruumis-andmelekked-ja-haired-riigi-e-teenustes
- ZoomEye, https://www.zoomeye.ai/
ZoomEye Query Notes
All counts were collected on 2026-10-14 UTC with sub_type=all. Queries and results:
| Query | Matching assets |
|---|---|
country="EE" && industry="government" |
263 |
country="EE" && service="https" && is_domain=true |
21,335 |
country="EE" && port="443" |
135,740 |
Matches are internet-visible observations at query time. They are not confirmed vulnerable, exploited or compromised systems, and the counts are not additive.
Top comments (0)