text: July 2022

text: July 2022

text: July 2022

text: See https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-the-eecc, March 2021

text: July 2022

text: See https://www.enisa.europa.eu/publications/threat-landscape-for-supply-chain-attacks

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: See https://resilience.enisa.europa.eu/article-13/guideline-for-incident-reporting 4 See Security supervision changes in the new EU telecoms legislation — ENISA (europa.eu) 5 See When & How to Report Security Incidents — ENISA (europa.eu)

text: July 2022

text: July 2022

text: See https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-the-eecc

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022 Figure 10: Root causes of incidents vs user hours lost – Telecom security incidents in 2021

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022 Figure 22: Root cause categories - Telecom security incidents in the EU reported over 2012- 2021

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: July 2022

text: Technical Guideline on Incident Reporting under the EECC — ENISA (europa.eu)

identifier: Telecom Security Incidents 2021

title: Telecom Security Incidents 2021

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: For technical queries about this paper, please email info@enisa.europa.eu. For media enquiries about this paper, please email press@enisa.europa.eu.

text: AUTHORS

text: Apostolos Malatras, Georgia Bafoutsou, Edgars Taurins, Marnix Dekker, European Union Agency for Cybersecurity

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from the members of the ENISA ECASEC expert group, which comprises national telecom regulatory authorities (NRAs) from the EU and EEA, EFTA and EU candidate countries.

text: LEGAL NOTICE

text: It should be noted that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed as a legal action of ENISA or ENISA bodies unless adopted pursuant to

text: Regulation (EU) No 526/2013

text: . This publication may be updated by ENISA from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2022 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that are not under ENISA copyright, permission must be sought directly from the copyright holders.

text: Catalogue number: TP-07-22-711-EN-N ISBN: 978-92-9204-582-1 DOI: 10.2824/528645

text: TELECOM SECURITY INCIDENTS 2021

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 7 2. BACKGROUND AND POLICY CONTEXT 8

text: 2.1 POLICY CONTEXT 8

text: 2.2 INCIDENT REPORTING FRAMEWORK 8

text: 2.3 INCIDENT REPORTING TOOL 9

text: 3. ANALYSIS OF INCIDENTS 11

text: 3.1 CATEGORIES OF ROOT CAUSES 11

text: 3.2 USER HOURS LOST IN EACH CATEGORY OF ROOT CAUSES 12

text: 3.3 DETAILED CAUSES AND USER HOURS LOST 13

text: 3.4 SERVICES AFFECTED 18

text: 3.5 TECHNICAL ASSETS AFFECTED 18

text: 4. DEEP DIVE ANALYSIS OF THE TECHNICAL CAUSES OF INCIDENTS 20

text: 4.1 HARDWARE FAILURES 20

text: 4.2 SOFTWARE BUGS 20

text: 4.3 FAULTY SOFTWARE CHANGES/UPDATES 21

text: 5. MULTI-ANNUAL TRENDS 22

text: 5.1 MULTI-ANNUAL TRENDS – CATEGORIES OF ROOT CAUSES 22

text: 5.2 MULTI-ANNUAL TRENDS - IMPACT FOR EACH SERVICE 24

text: 5.3 MULTI-ANNUAL TRENDS - USER HOURS FOR EACH ROOT CAUSE 25

text: 5.4 MULTI-ANNUAL TRENDS FOR THE SEVERITY OF IMPACT OF INCIDENTS 26

text: 5.5 MULTI-ANNUAL TRENDS FOR THE NUMBER OF INCIDENTS AND USER HOURS LOST 27

text: 6. CONCLUSIONS 28 TELECOM SECURITY INCIDENTS 2021

text: EXECUTIVE SUMMARY

text: In the EU, telecom operators notify significant security incidents to their national authorities. At the start of every calendar year, the national authorities send a summary of these reports to ENISA. This report, the Annual Report Telecom Security Incidents 2021, provides anonymised In 2021, 7% of the and aggregated information about major telecom security incidents in 2021. total user hours

text: lost were due to

text: The reporting of security incidents has been part of the EU’s regulatory framework for telecoms system failures

text: and an excessive

text: since the 2009 reform of the telecoms package.

text: Article 13

text: a of the Framework Directive (

text: ) came into force in 2011. The European Electronic Communications Code amount was lost

text: due to human

text: (EECC) (2018/1972) repeals and replaces the Framework Directive. It reinforces the provisions

text: errors (90%).

text: for reporting incidents, clarifying what incidents fall within its scope and the notification criteria.

text: The downwards

text: STATISTICS EXTRACTED FROM THE ANNUAL SUMMARY REPORTING

text: trend concerning PROCESS 2021 impact on mobile

text: The 2021 annual summary contains reports of 168 incidents submitted by national authorities

text: telephony that

text: from 26 EU Member States (MS) and 2 EFTA countries. The total user hours lost, derived by

text: commenced in

text: multiplying for each incident the number of users by the number of hours, was 5,106 million user

text: 2019 continued in

text: hours, a huge increase compared to 841 million user hours lost in 2020. These numbers are

text: clearly much higher compared to those of previous years, as can be seen in the following graphic.The reason for this is the impact of a notable EU-wide incident that was reported

text: The total user

text: separately by three MS. ENISA has published technical guidelines on incident reporting under

text: hours lost in 2021

text: the EECC , including on thresholds and calculating hours lost.

text: was 5,106 million user hours.

text: Figure 1: Number of incidents submitted by countries and user hours lost each year (2012- 2021)

text: Over the course of

text: 11 years, EU Member States reported a total of 1,431 telecom security incidents.

text: THE KEY TAKEAWAYS FROM INCIDENTS IN 2021

text: • Reporting of incidents related to OTT services requires further attention. Four per cent of reported incidents in 2021 refer to OTT communication services (4,16%). The

text: TELECOM SECURITY INCIDENTS 2021

text: same EU-wide OTT incident was reported three times by three different MS in three different ways, so there is a need for clarity as to who reports such incidents, which authority is in charge and what information is reported. The results of incident reporting in 2021 are skewed because of the huge impact caused by this incident being reported three times.

text: • For the first time, incidents concerning confidentiality and authenticity were reported. The reporting of such incidents was a new provision of EECC and in this respect no such incidents were reported in previous years. Three relevant incidents were reported in 2021 and this number is expected to grow in coming years.

text: • Malicious actions doubled in 2021. In 2020, incidents marked as malicious actions represented 4% of the total, a number which rose to 8% in 2021. Moreover, it is interesting to highlight the significant increase in DDoS attacks compared to 2020 when only four such incidents had been reported resulting in 1 million user hours lost. By comparison, in 2021 ten DDoS related incidents were reported, leading to a loss of 55 million user hours. These results are consistent with the findings of the ENISA Threat Landscape that point to an increase in DDoS attacks and a general increase in attacks against availability of services.

text: • System failures continue to dominate in terms of impact but the downward trend continues. System failures accounted for 363 million user hours lost compared to 419 million user hours in 2020. Despite the skewed nature of the 2021 results, it is noteworthy that there was a 14% decrease in user hours lost, whereas in terms of the number of incidents in 2021 they represent 59% of the total compared to 61% in 2020. This highlights the growing maturity of electronic communication providers in handling and containing the impact of system failures.

text: • Incidents caused by human errors remain at the same level as in 2020. Around a quarter (23%) of total incidents have human errors as a root cause (a slight decrease compared to 26% in 2020), however 91% of the total user hours lost have been lost due to this kind of incident. These results however are skewed due to the OTT communication services incident reporting issues mentioned above.

text: • In 2021, there was a noteworthy decrease in incidents flagged as failures by third parties. Only 22% of incidents were reported as being related to third-party failures compared to 29% in 2020 and 32% in 2019. No third-party failures related to malicious actions were reported. Overall, the finding suggests that electronic communication providers have started introducing targeted security controls to better protect their supply chains, echoing the relevant ENISA calls for attention .

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 2: Share of users’ hours lost for each root cause category

text: ENISA offers an online visual tool for analysing incidents, which can be used to generate custom graphs. See: https:/ciras.enisa.europa.eu.

text: MULTI-ANNUAL TRENDS OVER THE LAST DECADE

text: For more than a decade now, ENISA and the national authorities in EU Member States have been collecting and analysing telecom security incident reports. Over the course of 11 years, EU Member States reported 1,431 telecom security incidents. ENISA stores these in a tool called CIRAS (Cybersecurity Incident Reporting and Analysis System) and the statistics are accessible online.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 3: Root cause categories for telecom security incidents in the EU reported over 2012- 2021 period

text: Over the last couple of years, the following trends have been noted:

text: • Number of incidents is stabilising: the total number of incidents reported is stabilising at around 160 annually. Over the period 2014-2021, a consistent over the years number of incidents have been reported and this is stabilising at around 160 incidents per year.

text: • Malicious actions continue to constitute a minority of incidents: over the reporting period, the frequency of malicious actions was stable (accounting for approximately 5% of incidents each year, although in 2021 there was a spike at 8%). Their impact in terms of user hours was stable also.

text: Currently the focus of the national authorities for telecom security is on the transposition and implementation of the EECC, which brings several changes. The incident reporting requirements in Article 40 of the EECC have a broader scope including explicitly, for example, breaches of confidentiality. In addition, the arrival of the Network and Information Security (NIS) Directive 2 in 2022 is expected to be a game changer in incident reporting, since it consolidates the reporting of security breaches across a variety of legislations including but not limited to the EECC.

text: Moreover, in the context of the new EECC, targeted attacks involving for instance those using SS7 protocol vulnerabilities, SIM Swapping frauds, attacks using the Flubot malware or even more extended attacks that cause no outages, such as wiretapping or a BGP hijack, would be reportable under Article 40 of the EECC.

text: ENISA will continue to work with national authorities as well as the NIS Cooperation group to find and exploit synergies between different pieces of EU legislation, particularly when it comes to incident reporting and cross-border supervision.

text: TELECOM SECURITY INCIDENTS 2021

text: 1. INTRODUCTION

text: Electronic communication providers in the EU have to notify security incidents that have a significant impact on the continuity of electronic communication services to the national telecom regulatory authorities (NRAs) in each EU member state. Every year the NRAs report a summary

text: This is the 11th

text: to ENISA, covering a selection of these incidents, i.e. the most significant incidents, based on a

text: ENISA annual

text: set of agreed EU-wide thresholds. This document, the Annual Security Incidents Report 2021, incident report for aggregates the incident reports received in 2021 and gives a single EU-wide overview of

text: the telecom sector.

text: telecom security incidents in the EU.

text: Mandatory incident

text: This is the 11th year ENISA is publishing an annual incidents report for the telecom sector. reporting has been ENISA started publishing these annual reports in 2012. Mandatory incident reporting has been part of the EU’s part of the EU’s telecom regulatory framework since the 2009 reform of the telecom package:

text: telecom regulatory

text: Article 13

text: a of the Framework directive (

text: ) came into force in 2011. framework since

text: The mandatory reporting of incidents under

text: Article 13

text: a had a specific focus on security incidents with a significant impact on the functioning of each category of telecommunication Reform of the services. Over the years, the regulatory authorities have agreed to focus mostly on

text: telecom package:

text: network/service outages (type A incidents). This would exclude from the scope of these reports

text: Article 13

text: a of the targeted attacks, e.g. those involving the use of SS7 protocol vulnerabilities, SIM Swapping

text: Framework

text: frauds, or even more extended attacks that nevertheless do not cause outages.

text: directive (

text: ) has

text: The relevant update of the EU telecom rules, namely the European Electronic Communications been further Code (EECC), that was expected to be harmonised in Member States by the end of 2020, expanded in the includes a broader scope on the requirements for incident reporting in

text: Article 40

text: . These European requirements explicitly include, for example, breaches of confidentiality. 2021 is the second time Electronic ENISA has also received three type B reports of incidents (breaches of confidentiality). Communications

text: Code.

text: This document is structured as follows: in section 2, the policy context and background is provided. The reporting procedure is briefly summarised. In addition, the types of incidents that get reported are described. Some specific but anonymised examples of incidents that occurred in 2021 are also discussed. In Section 3, key facts and statistics about incidents in 2021 are provided. In Section 4, there is a closer look at faulty software changes, and in section 5 a look at multi-annual trends over the years 2012-2021.

text: It is important to note that the telecom security incidents that are reported to national authorities are only the major incidents, i.e. those with significant impacts. Smaller incidents, affecting small percentages of population such as SIM Swapping attacks are not reported.

text: Note that conclusions about trends and comparisons with previous years have to be made with a degree of caution as national reporting thresholds change over the years. Indeed reporting thresholds have been lowered in most countries in recent years and, as mentioned, reporting only covers the most significant incidents (and not smaller incidents that may well be more frequent).

text: TELECOM SECURITY INCIDENTS 2021

text: 2. BACKGROUND AND POLICY CONTEXT

text: In this chapter the policy context is explained as well as the main features of the incident reporting process, as described in

text: Article 13

text: a Technical Guideline on Incident Reporting , which was developed in collaboration with national authorities.

text: 2.1 POLICY CONTEXT

text: Security incident reporting is a hallmark of EU cybersecurity legislation and it is an important enabler for the supervision of cybersecurity and for policymaking at national and EU level. Since 2016 security incident reporting is also mandatory for trust service providers in the EU under Article 19 of the EIDAS regulation. In 2018, under the NIS Directive (NISD), security incident reporting became mandatory for Operators of Essential Services in the EU and for Digital Service Providers, under

text: Article 14

text: and Article 16 of the NIS directive.

text: By the end of 2020, the European Electronic Communications Code (EECC) came into effect across the EU, but was only implemented into national legislation in some EU countries. The year 2021 saw progress in the implementation of EECC by MS; however the process has not yet been completed.

text: Under Article 40 of the EECC the incident reporting requirements have a broader scope, including not only outages but also, for instance, breaches of confidentiality. In addition, there are more services within the scope of the EECC, including not only traditional telecom operators but also, for example, over-the-top providers of communications services (such as messaging services like Viber and WhatsApp, etc.).

text: In 2020, the annual reporting guideline was updated to include new thresholds for annual summary reporting to ENISA. These combine quantitative and qualitative parameters as well as the notification of security incidents affecting not only the services of fixed and mobile internet and telephony, but also number-based interpersonal communications services and/or number independent interpersonal communications services (OTT communications services) .

text: It is, nevertheless, important to note that the main characteristic of 2020 and 2021 was the COVID-19 pandemic, which radically transformed the way people around the globe live and work, turning everything digital. As such, there was extensive supervision from the European Commission on the reporting by all Member States of incidents of network congestion. Comparing incident reporting results from 2019 and before, it is fair to conclude that the European telecommunication networks have shown robustness and resilience.

text: 2.2 INCIDENT REPORTING FRAMEWORK

text: Article 13

text: a of the Framework Directive and Article 40 of the EECC provides for three types of incident reporting:

text: 1) National incident reporting from providers to NRAs, 2) Ad-hoc incident reporting between NRAs and ENISA, and

text: TELECOM SECURITY INCIDENTS 2021

text: 3) Annual summary reporting from national authorities to the EC and ENISA.

text: The different types of reporting are shown in Figure 4.

text: Figure 4: Incident reporting under EECC

text: article 40

text: Note that in this setup ENISA acts as a collection point, anonymising, aggregating and analysing the incident reports. In the current setup, NRAs can search incidents in the reporting tool (CIRAS) but the incident reports themselves do not refer to countries or providers, making the overall summary reporting process less sensitive.

text: 2.3 INCIDENT REPORTING TOOL

text: ENISA maintains an incident reporting tool, CIRAS, for the authorities where they can upload reports and search for and study specific incidents.

text: For the public, ENISA also offers an online visual tool, which is publicly accessible and can be used for custom analysis of the data: https://ciras.enisa.europa.eu/. This tool anonymises the country or operator involved.

text: The reporting template starts with a selector for the type of incident and contains three parts:

text: 1. Impact of the incident ̶ communication services impacted and by how much; 2. Nature of the incident ̶ the cause of the incident; 3. Details of the incident ̶ detailed information about the incident, including a short description, the types of network, the types of assets, the severity level etc.

text: CIRAS is a free online tool where ENISA stores reported incidents and provides annual and multi-annual statistics. TELECOM SECURITY INCIDENTS 2021

text: The type selector distinguishes six types of cybersecurity incidents (see Figure 5). The different types are explained below.

text: Figure 5: Types of cybersecurity incidents

text: Type A: Service outage (e.g. continuity, availability). For example, an outage caused by a cable cut due to a mistake by the operator of an excavation machine used for building a new road would be categorised as a type A incident.

text:  Type B: Other impact on service (e.g. confidentiality, authenticity, integrity). For example, a popular collaboration tool has not encrypted the content of the media channels, which are being established when a session is started, between the endpoints participating in the shared session. This leads to the interception of the media (voice, pictures, video, files, etc.) through a man-in-the-middle attack. This incident would be categorised as a type B incident.

text:  Type C: Impact on other systems (e.g. ransomware in an office network, no impact on the service). For example, a malware has been detected on several workstations and servers of the office network of a telecom provider. This incident would be categorised as a type C incident.

text:  Type D: Threat or vulnerability (e.g. discovery of crypto flaw). For instance, the discovery of a cryptographic weakness would be categorised as a type D incident.

text:  Type E: Impact on redundancy (e.g. failover or backup system). For example, when one of two redundant submarine cables breaks would be categorised as a type E incident.

text:  Type F: Near-miss incident (e.g. activation of security measures). For instance, a malicious attempt that ends up in the honeypot network of a telecom provider would be categorised as a type F incident.

text: For more information about the incident reporting process, please refer to ‘Technical Guideline on Incident Reporting under the EECC’

text: TELECOM SECURITY INCIDENTS 2021

text: 3. ANALYSIS OF INCIDENTS

text: For the year 2021, 26 EU Member States and 2 EFTA countries participated in the annual reporting process, describing 168 significant incidents (compared to 170 in 2020). In this section, the 168 reported incidents are aggregated and analysed. First, the impact on each root 168 cause category is analysed in section 3.1. In section 3.2 the focus is on the user hours that telecom were lost in each root cause category. Detailed causes are then examined in Section 3.3, and in

text: security

text: Section 3.4 the impact on each service is analysed.

text: incidents reported in

text: One of the highlights of incident reporting under the EECC in 2021 is the fact that for the first

text: 2021 by EU

text: time three out of the 168 incidents were marked as Type B, namely as impacting confidentiality and authenticity of services. All the other incidents impacted availability and were thus marked Member as Type A. Incidents of the other 4 types were not reported in 2021. States.

text: 3.1 CATEGORIES OF ROOT CAUSES

text: In 2021, there was a slight drop in incidents related to both system failures and human errors, the two categories which consistently rank the highest (see Figure 6). About 23% of security incidents were caused by human errors (compared to 26% in 2020) and 59% of telecom incidents were marked as system failures, a slight decrease compared to 2020 (61%). Notably, malicious actions almost doubled in the course of 2021 (8%) compared to 2020 (4%) and natural phenomena remained consistent with 2020 (10% in 2021 up slightly from 9% in 2020).

text: Figure 6: Root cause categories – Telecom security Incidents in 2021

text: In 2021, there was a noteworthy decrease in incidents that were flagged as third-party failures. Only 22% of the incidents were reported as being related to third-party failures compared to 29% in 2020 and 32% in 2019. No third-party failures related to malicious actions were reported, while the majority of them was related to system failures (see Figure 7).

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 7: Root cause categories – Telecom security incidents in 2021 (third-party failures)

text: 3.2 USER HOURS LOST IN EACH CATEGORY OF ROOT CAUSES

text: Adding up total user hours lost for each root cause category (see Figure 8) shows that more than 90% of the total user hours lost were due to human errors (91%; 4,632 million user hours), up from 40% and 351 million user hours in 2020. This is due to the fact that a particular incident affecting an OTT (Over-The-Top) communication service provider was reported three times by three different MS and in three different ways (i.e. incident data differences) since it impacted services across the EU.

text: This raises the issue of cross-border and EU-wide incidents and how they should be reported under the EECC, in particular for OTT communication service providers who by nature are not generally restricted to a single MS. 4442 user hours were lost due to human errors in the case of OTT communication service providers and 7M due to system failures.

text: System failures accounted for 7% of the cases (363 million user hours lost) compared to 50% and 419 million lost user hours in 2020. Despite the skewed nature of the results in 2021, it is noteworthy that there was a 14% decrease in user hours lost relared to system failures, a trend observed since 2019. This highlights the growing maturity of electronic communication providers in handling and containing the impact of system failures.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 8: Share of user hours lost for each root cause category

text: It is interesting to note the impact of incidents related to malicious actions on lost user hours. Interestingly, in 2021 lost user hours increased five times (from 13 million lost user hours in 2019 and 2020 to 70 million lost user hours in 2021). While the number of incidents doubled in 2021 compared to 2020, the significant increase in their related impact highlights the need to take further action in containing the adverse effect of such incidents.

text: 3.3 DETAILED CAUSES AND USER HOURS LOST

text: Detailed causes for all incidents are tracked, in addition to root cause categories (Figure 9). An incident is often a chain of events. For instance, an incident may be triggered by a storm, which tears down power supply infrastructure, cutting cables and thus power, which in turn results in a telecom outage. In this example, the root cause of the incident would be natural phenomena and the detailed causes would be: Heavy wind, Cable cut, Power cut, Battery depletion.

text: The most frequent detailed cause appearing in incident reports for 2021 is hardware failures followed by faulty software changes/updates and software bugs. In addition, many incident reports mention policy/procedural flaws, faulty hardware changes/updates and overloads. Figure 10 shows the frequency of detailed causes across incident reports for 2021 and the corresponding lost user hours.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 9: Detailed root causes – Telecom security incidents in 2021

text: 3.3.1.1 Breakdown of root causes

text: The graphs below break down the main root causes of system failures in terms of detailed causes and show the total number of incidents and user hours lost for each detailed cause.

text: It is noteworthy to mention that the thrice reported EU-wide OTT communication services incident concerning a faulty hardware update has significantly skewed the results concerning lost user hours. This is to be expected given the EU-wide user base affected and the fact that the same incident was reported three times by three distinct MS. Accordingly, more clarification of the incident reporting process concerning OTT communication services and cross-border, EU-wide incidents is required.

text: What follows is an overview of detailed causes and user hours lost for each category of incident in an effort to provide clarity and transparency for specific root causes, which differ significantly between categories of incidents.

text: TELECOM SECURITY INCIDENTS 2021

text: 3.3.1.2 Breakdown of System failures

text: Figure 11: Root causes of system failure incidents vs user hours lost – Telecom security incidents in 2021 (system failures)

text: TELECOM SECURITY INCIDENTS 2021

text: 3.3.1.3 Breakdown of Human errors

text: Figure 12: Root causes of human error incidents vs user hours lost – Telecom security incidents in 2021 (human errors)

text: 3.3.1.4 Breakdown of natural phenomena

text: Figure 13: Root causes of natural phenomena incidents vs user hours lost – Telecom security incidents in 2021 (natural phenomena)

text: TELECOM SECURITY INCIDENTS 2021

text: 3.3.1.5 Breakdown of malicious actions

text: Figure 14: Root causes of malicious action incidents vs user hours lost – Telecom security incidents in 2021 (malicious actions)

text: When it comes to malicious actions it is interesting to highlight the significant increase in DDoS (Distributed Denial of Service) attacks compared to 2020 when only four such incidents were reported resulting in one million user hours lost. Conversely, in 2021 ten DDoS related incidents were reported, leading to a loss of 55 million user hours. Figure 15: Services affected – Telecom security incidents in 2021

text: TELECOM SECURITY INCIDENTS 2021 3.4 SERVICES AFFECTED

text: In this section the services affected by incidents are examined. For the sixth year in a row, most of the reported incidents affected mobile services. In 2021, around 45% of reported incidents had an impact on mobile telephony and internet in the EU. This confirms the shift observed over the last few years from fixed telephony, which was most affected service only in the early years of reporting.

text: It is also important to note that in comparison to 2020 reported incidents affecting OTT services rose to 4% of all reported incidents in 2021. This highlights the growing maturity in the reporting of such incidents, albeit needing more clarifications in terms of procedures and processes given the particular thrice reported incident mentioned above.

text: Note that for most reported incidents there was an impact on more than one service, which explains why the percentages in Figure 15 add up to more than 100%.

text: 3.5 TECHNICAL ASSETS AFFECTED

text: Each incident report also describes the (secondary) assets affected during the incident. Figure 16 shows the assets most affected.

text: Figure 16: Assets affected – Telecom security incidents 2021

text: It is also noticeable, taking into account incidents over the last 5 years as seen in Figure 17, that switches and routers as well as mobile base stations and controllers are the two assets that have been affected the most in recent years.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 17: Assets affected – Telecom security incidents 2017-2021

text: TELECOM SECURITY INCIDENTS 2021

text: 4. DEEP DIVE ANALYSIS OF THE TECHNICAL CAUSES OF INCIDENTS

text: This section contains an in-depth review of the most high-profile technical causes behind reported incidents, focussing not only on 2021 but also on previous years. 53 M user hours

text: lost due to 4.1 HARDWARE FAILURES hardware failures

text: In 2021, 31 incidents (18% of total) were marked as hardware failures and they resulted in 53

text: in 2021, 1% of the

text: million user hours lost (1% of the total) as seen in Figure 18. All of them were reported as

text: total

text: system failures.

text: Figure 18: Incidents with hardware failures as root cause – Telecom security incidents in the EU in 2021

text: 4.2 SOFTWARE BUGS

text: In 2021, 26 incidents (15% of total) were marked as being due to software bugs and they resulted in 216 million user hours lost (4% of the total) as can be seen in Figure 19. All but one of them were reported as system failures, with one incident being reported as due to human error.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 19: Incidents having software bugs as root cause – Telecom security incidents in the EU in 2021

text: 4.3 FAULTY SOFTWARE CHANGES/UPDATES

text: In 2021, 15% of total incidents (26 incidents) were marked as due to faulty software changes or updates resulting in 225 million user hours lost (4% of the total) as can be seen in Figure 20.

text: Figure 20: Incidents having faulty software changes/updates as their root cause – Telecom security incidents in the EU in 2021

text: TELECOM SECURITY INCIDENTS 2021

text: 5. MULTI-ANNUAL TRENDS

text: ENISA has been collecting and aggregating incident reports since 2012. In this section multiannual trends over the last 11 years, from 2012 to 2021, are presented. This dataset contains 1,431 reported incidents in total (see Figure 21). Over the course of the last 5 years, the number of incidents has been stabilising at around the 160 mark per annum.

text: Figure 21: Number of incidents reported per year (2012-2021)

text: 5.1 MULTI-ANNUAL TRENDS – CATEGORIES OF ROOT CAUSES

text: Every year from 2012 to 2021, system failures were the most common root cause. In 2021, however, system failures showed stabilisation and a slight decrease, continuing the trend first observed in 2020 as seen in Figure 22.

text: In total, system failures accounted for 925 incident reports (64% of the total). For this root cause category, over the last 11 years, the most common causes were hardware failures (34%) and software bugs (27%). The second most common root cause over the 11 years of reporting is human errors with nearly a fifth of total incidents (19%, 286 incidents in total). Natural phenomena come third at almost a tenth of total incidents (9%, 139 incidents in total).

text: Only 5% of incidents have been categorised as malicious actions (73 incidents over the course of 11 years). In the period 2012-2021 nearly two thirds of malicious actions consisted of Denial of Service attacks (64%), while the remainder were mainly comprised of lasting damage to physical infrastructure, e.g. arson, cable cuts, etc. Only 4% was attributed to malware and viruses (see Figure 23).

text: Interestingly, the assets affected by malicious actions differ significantly from the overall categorisation of affected assets. Addressing servers came first with 23%, followed by switches and routers at 18% (see Figure 24). Moreover, 63% referred to fixed Internet services and 41% to mobile Internet services, whereas 2% referred to OTT services.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 23: Technical causes for incidents due to malicious actions – Telecom security incidents in the EU reported over 2012-2021

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 24: Assets affected by incidents due to malicious actions – Telecom security incidents in the EU reported over 2012-2021

text: 5.2 MULTI-ANNUAL TRENDS - IMPACT FOR EACH SERVICE

text: In 2021, mobile networks and services were once more the most impacted by incidents. However there was a decrease compared to 2019 and 2020 and, interestingly, the statistics in terms of services affected are converging for both fixed and mobile. More importantly, in 2021 reporting of incidents related to OTT communication services took place (in contrast to 2020 where no such incidents were reported). In addition, the increase in broadcast related incidents that was observed for two years in a row (2019 and 2020) persists also in 2021.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 25: Trends on impact for each service reported over 2012-2021

text: 5.3 MULTI-ANNUAL TRENDS - USER HOURS FOR EACH ROOT CAUSE

text: In terms of overall impact, as indicated in Figure 26, human errors have been steadily increasing since 2016. In 2020, their share in terms of impact was almost the same as system failures. In 2021, given the particularities of OTT incident reporting that were previously analysed, the results are heavily skewed towards human errors.

text: The overall impact of natural phenomena has been trending down over the last three years after peaking in 2018 (caused by extreme weather and wildfires). Notably, the impact of malicious actions is steadily rising, reaching a 5-year high of 70 million lost user hours in 2021.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 26: User hours lost for each category of root causes - multi-annual 2012-2021 (user hours lost)

text: 5.4 MULTI-ANNUAL TRENDS FOR THE SEVERITY OF IMPACT OF INCIDENTS

text: Over the last 5 years a noteworthy and constant decrease in reports of incidents with very large severity has been observed. ENISA has published technical guidelines on incident reporting under the EECC , including on thresholds, severity estimation and calculating hours lost. Conversely, there has been a steady increase in minor and large incidents. These findings point on one hand to the growing maturity of electronic communication providers with respect to the incident reporting process and on the other hand to the improvement of resilience and the provision of security services (including incident reporting itself) that has led to a lower number of very large severe incidents.

text: Relevant multi-annual trends may be found in Figure 27.

text: TELECOM SECURITY INCIDENTS 2021

text: Figure 27: Severity of impact for each year - multi-annual trends 2012-2021 (number of incidents)

text: 5.5 MULTI-ANNUAL TRENDS FOR THE NUMBER OF INCIDENTS AND USER HOURS LOST

text: Over the years, the number of incidents has increased steadily and is now stabilising at around 160-170 a year.

text: Figure 28: Number of incidents and user hours lost each year

text: TELECOM SECURITY INCIDENTS 2021

text: 6. CONCLUSIONS

text: This document, the Annual Report Telecom Security Incidents 2021, covers the incidents reported by the authorities for the calendar year 2021 and it gives an anonymised, aggregated EU-wide overview of telecom security incidents. It marks the 11th time ENISA has published an annual report for the telecom sector. To conclude here are the main findings and some general observations about this process and the broader policy context.

text: MAIN FINDINGS

text: • Reporting of incidents related to OTT services requires further attention. Four per cent of reported incidents in 2021 refer to OTT services. The same EU-wide OTT incident was reported three times by three different MS in three different ways, so there is a need for clarification on who reports such incidents, which authority is in charge and what information is to be reported. The results of 2021 incident reporting are skewed because of the huge impact of this incident which was reported three times.

text: • For the first time, incidents concerning confidentiality and authenticity were reported. The reporting of such incidents was a new provision of the EECC and in this respect no such incidents were reported in the previous years. Three relevant incidents were reported in 2021 and this number is expected to grow in the coming years.

text: • Malicious actions doubled in 2021. In 2020, incidents marked as malicious actions represented 4% of the total, a number which rose to 8% in 2021. Moreover, it is interesting to highlight the significant increase in DDoS attacks compared to 2020 when only four such incidents had been reported resulting in one million user hours lost. By comparison, in 2021 ten DDoS related incidents were reported, leading to a loss of 55 million user hours. These results are consistent with the findings of the ENISA Threat Landscape that point to an increase in DDoS attacks and, in general, an increase in attacks against the availability of services.

text: • System failures continued to dominate in terms of impact, but the downward trend continued. System failures accounted for 363 million user hours lost compared to 419 million user hours lost in 2020. Despite the skewed nature of the results for 2021, it is noteworthy that there was a 14% decrease in user hours lost, whereas in terms of the number of incidents in 2021 they represent 59% of the total compared to 61% in 2020. This highlights the growing maturity of electronic communication providers in handling and containing the impact of system failures.

text: • Incidents caused by human errors remained at the same level as in 2020. Around a quarter (23%) of total incidents have human errors as a root cause (slightly decreased compared to the 26% of 2020). However 91% of the total user hours lost were due to this kind of incident. These results however are skewed due to the OTT incident reporting issues mentioned above.

text: • In 2021, a noteworthy decrease in incidents that were flagged as third-party failures was observed. Only 22% of the incidents were reported as being related to third-party failures compared to 29% in 2020 and 32% in 2019. No third-party failures related to malicious actions were reported. Overall, this finding suggests that electronic communication providers have started introducing targeted security controls to better protect their supply chains, echoing the relevant ENISA calls for attention .

text: GENERAL OBSERVATIONS

text: • At the end of 2020, the European Electronic Communications Code (EECC) came into effect across the EU. Some countries have already implemented the EECC but many

text: TELECOM SECURITY INCIDENTS 2021

text: are still transposing. Transposing the EECC and implementing its provisions will be a key focus for ENISA and the national authorities this year and in the coming years.

text: • In May 2022, there was a political agreement on the Network and Information Security (NIS) Directive 2. The official text is expected in the course of 2022 with an expected transposition deadline of 21 months for MS. The NIS 2 brings significant changes to security incident reporting in the EU by consolidating all relevant streams under the NIS 2 umbrella, namely consolidating incident reporting under EECC, NIS2 and eIDAS regulations among others. ENISA will be working with national authorities and regulators in the coming years on how to implement the consolidated reporting of incidents under NIS2.

text: • Under Article 40 of the EECC, the incident reporting provisions have changed slightly . For instance, under the EECC, mandatory incident reporting also applies to independent interpersonal communications services (OTT communications services). To address these changes ENISA published a new incident reporting guideline at the start of 2020. From 2021, these changes were beginning to be seen in the reporting data. However, issues still persist as was evident from the EU-wide incident that was reported by three MS and was done so in three different ways. Taking into account the different reporting thresholds of Member States, there needs to be more clarity and coordination on how cross-border incidents are reported, by whom and using what thresholds. ENISA will work closely with national authorities and regulators to find an optimal way to address this issue.

text: • One issue that was observed in 2020 and persists in 2021 is that many smaller-scale incidents, however frequent, remain under the radar. Some of these incidents, such as targeted DDoS attacks, SIM Swapping and SS7 attacks, can still have major impacts on individual customers. In coming years, this area needs to be analysed better with the possible introduction of a summary reporting format for these smaller scale incidents. To begin with, in 2022, bulk incident reporting using machine-readable formats was introduced to CIRAS in order to facilitate reporting and alleviate the administrative burden.

text: • The 5G roll out will continue to require a lot of attention, both from authorities and from the providers. At ENISA, the focus is on supporting the national authorities in the ENISA ECASEC group and in the NIS Cooperation group, with technical guidance, and also by organising dedicated seminars and panels. ENISA looks forward to continuing its close collaboration with EU Member States, the national telecom authorities and experts from the telecom sector from across Europe to implement security incident reporting efficiently and effectively.

text: -N -EN -711 -22 -07 TP

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ISBN: 978-92-9204-582-1 DOI: 10.2824/528645


text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: ( ) The reporting of security incidents has been part of the EU’s regulatory framework for telecoms since the 2009 reform of the telecoms package, in line with

text: Article 13

text: a of the framework directive (

text: ) that came into force in 2011. ( ) It is worth noting that since 2016 security incident reporting is also mandatory for trust service providers in the EU under Article 19 of the eiDAS regulation. In 2018, under the NIS directive, security incident reporting became mandatory for operators of essential services in the EU and for digital service providers, under

text: Article 14

text: and Article 16 of the NIS directive. ( ) ENISA technical guidelines on incident reporting under the EECC, including on thresholds and calculation of hours lost. ( ) Derived by multiplying for each incident the number of users by the number of hours.

text: March 2024

text: ( ) The reporting of type B incidents was a new provision of the EECC in 2021.

text: March 2024

text: ( ) Note that conclusions about trends and comparisons with previous years have to be made with caution, as national reporting thresholds change over the years. Indeed, reporting thresholds have been lowered in most countries in recent years, and reporting only covers the most significant incidents (not smaller incidents that may well be more frequent).

text: March 2024

text: ( ) Also called ‘ECASEC’. https://resilience.enisa.europa.eu/article-13 https://www.enisa.europa.eu/topics/critical-information-infrastructures-and-services/telecoms

text: March 2024

text: March 2024

text: ( ) Note that the telecom security incidents that are reported to national authorities are only the major incidents, i.e. those with significant impacts. Smaller incidents, affecting small percentages of population, such as SIM-swapping attacks or fraud are not reported, since they do not cause outages. ( ) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX %3A32018L1972 ( ) In 2021, 165 incidents were reported, among them three marked as type B, impacting confidentiality and authenticity of services. Until 2021, incidents of the other four types had not been reported.

text: March 2024

text: ( ) See https://resilience.enisa.europa.eu/article-13/guideline-for-incident-reporting. ( ) See https://digital-strategy.ec.europa.eu/en/policies/eu-electronic-communications-code. ( ) See Security supervision changes in the new EU telecoms legislation – ENISA (europa.eu). ( ) See When & How to Report Security Incidents – ENISA (europa.eu).

text: March 2024

text: March 2024

text: ( ) See https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-the-eecc.

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: ( ) ‘Other’ implies that no information was provided. Therefore, there will be a need to provide more information in future incident reports.

text: March 2024

text: ( ) It bears noting that for most reported incidents there was an impact on more than one service, which explains why the percentages in Figure 15 add up to more than 100 %. ( ) These newly introduced services and data still need to be consolidated and normalised over 3 years. In 2021, OTT represented 4 %.

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: March 2024

text: March 2024 Figure 23: Assets affected by incidents due to malicious actions v assets affected by all types of incidents

text: March 2024

text: March 2024

text: March 2024

text: ( ) See https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-the-eecc, March 2021.

text: March 2024

text: March 2024

text: March 2024

identifier: Telecom Security Incidents 2022

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Telecom Security Incidents 2022

serie: rapporter

text: EUROPEAN UNION AGENCY FOR CYBERSECURITY

type: rubrik

text: TELECOM SECURITY INCIDENTS 2022

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2022

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For technical queries about this paper, please email incidentreporting@enisa.europa.eu For media enquiries about this paper, please email press@enisa.europa.eu

text: Author

text: Marie-Laure LULE, European Union Agency for Cybersecurity

text: Acknowledgements

text: We are grateful for the review and input received from the members of the ENISA ECASEC expert group, which comprises national telecom regulatory authorities (NRAs) from the EU and European Economic Area, European Free Trade Association and EU candidate countries.

text: Legal notice

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: Copyright notice

text: © European Union Agency for Cybersecurity (ENISA), 2024

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: TELECOM SECURITY INCIDENTS 2022

text: For any use or reproduction of photos or other material that are not under ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-668-2 DOI: 10.2824/902186 TELECOM SECURITY INCIDENTS 2022

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 10 2. BACKGROUND AND CONTEXT 11

text: 2.1 POLICY CONTEXT 11

text: 2.2 INCIDENT REPORTING FRAMEWORK 11

text: 2.3 INCIDENT REPORTING TOOL 12

text: 3. ANALYSIS OF INCIDENTS 14

text: 3.1 CATEGORIES OF ROOT CAUSES OF INCIDENTS 14

text: 3.2 USER HOURS LOST IN EACH CATEGORY OF ROOT CAUSES 15

text: 3.3 DETAILED ROOT CAUSES AND USER HOURS LOST 16

text: 3.3.1 Breakdown of root causes 17 3.3.2 Breakdown of system failures 17 3.3.3 Breakdown of human errors 18 3.3.4 Breakdown of natural phenomena 19 3.3.5 Breakdown of malicious actions 20

text: 3.4 SERVICES AFFECTED 21

text: 3.5 TECHNICAL ASSETS AFFECTED 22

text: 4. DEEP-DIVE ANALYSIS OF THE TECHNICAL CAUSES OF INCIDENTS 23

text: 4.1 HARDWARE FAILURES 23

text: 4.2 SOFTWARE BUGS 23

text: 4.3 FAULTY SOFTWARE CHANGES/UPDATES 24

text: 5. MULTIANNUAL TRENDS 25

text: 5.1 MULTIANNUAL TRENDS – CATEGORIES OF ROOT CAUSES 25

text: 5.2 MULTIANNUAL TRENDS – IMPACT ON EACH SERVICE 28

text: 5.3 MULTIANNUAL TRENDS – USER HOURS FOR EACH ROOT CAUSE 29

text: 5.4 MULTIANNUAL TRENDS FOR SEVERITY OF IMPACT OF INCIDENTS 30

text: TELECOM SECURITY INCIDENTS 2022

text: 5.5 MULTIANNUAL TRENDS FOR THE NUMBER OF INCIDENTS AND USER HOURS LOST 31

text: 6. CONCLUSIONS 32 TELECOM SECURITY INCIDENTS 2022

text: EXECUTIVE SUMMARY

text: The present report provides anonymised and aggregated information about major telecom security incidents that happened in 2022. Security incident reporting is a hallmark of EU cybersecurity legislation. It is an important enabler of cybersecurity supervision and a support tool for policymaking at the national and EU levels.

text: In the European Union, telecom operators notify significant security incidents to their national authorities. At the start of every calendar year, the national authorities send a summary of these reports to ENISA. The European Electronic Communications Code (EECC 2018/1972) reinforces the provisions ( ) for reporting incidents, clarifying what incidents fall within its 2 3 scope ( ), as well as the technical guidelines ( ) and the notification criteria. ENISA offers an online visual tool for analysing incidents, which can be used to generate custom graphs, available on https://ciras.enisa.europa.eu.

text: Key findings in 2022 summary report

text: The 2022 annual summary contains reports of 155 incidents submitted by national authorities from 26 EU Member States and two European Free Trade Association countries.

text: In 2022, 11 209 million user hours ( ) were lost in total, compared to 5 106 million in 2021. This is clearly a much higher number compared to previous years, as we can see in Figure 1. The reason for this is the important increase of incident reports related to Over-The-Top (OTT) services, a recent metric taken on board in the cybersecurity incident-reporting and analysis system since 2021.

text: Figure 1: Number of incidents submitted by countries and user hours lost each year (2012–2022)

text: TELECOM SECURITY INCIDENTS 2022 Key takeaways from incidents in 2022

text: Incident reporting confirms the following. • Mobile telephony and mobile internet were the most impacted sectors, with respectively 52 % and 40 % of incidents. • Over-The-Top services (OTT) accounted for 26 % of incidents. • Traditional fixed telephony, fixed internet and broadcasting services continued to drop in terms of incident reports. • System failures continued to largely dominate in terms of impact, reaching 72 % in 2022. They globally accounted for 10 481 million user hours lost (against 10 025 million for OTT) compared to 363 million user hours in 2021 and 419 million in 2020. In 2022, 36 incidents (23 % of total system failures) were marked as hardware failures. They resulted in 797 million user hours lost compared to 53 million in 2021. All of them were reported as system failures. • Human error incidents have steadily decreased since 2020, from 26 % in 2020 to 23 % 2021 and 15 % in 2022. Human error accounted for 135 million user hours lost in 2022. • Malicious actions accounted for 435 million of user hours lost in 2022, 6 % of that year’s total incidents, compared to 70 million (8% of that year’s total) in 2021 and 13 million (4% of that year’s total) in 2020. • Five distributed denial-of-service incidents were reported, resulting in 1 million user hours lost. • The share of incidents due to natural phenomena remained stable, at 6 %. However, the number of user hours lost increased. • Incidents flagged as failures by third parties represented 23 % of incidents, with a total of 35 incident reports, compared to 22 % in 2021, 29 % in 2020 and 32 % in 2019. Four of them originated from human errors, three from malicious actions and one from natural phenomena. • Five incidents concerning confidentiality and authenticity ( ) were reported, compared to three in 2021. • One incident concerning impact on redundancy was reported for the first time. • One incident concerning a near-miss incident was reported for the first time.

text: Figure 2: Root cause category (2022)

text: TELECOM SECURITY INCIDENTS 2022

text: Share of user hours lost for each root cause category, 2022

text: Multiannual trends over the period 2012–2022

text: Over the years, EU Member States reported 1 586 telecom security incidents, stored in the ENISA cybersecurity incident reporting and analysis system (CIRAS); the statistics ( ) are accessible online.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 3: Root cause categories for telecom security incidents in the EU reported over the 2012–2022 period

text: Over the years, the European Commission has extensively supervised Member States’ reporting of incidents with determined outages. Comparing incident reporting results over the years, it is fair to conclude that the European telecommunication networks have shown robustness and resilience.

text: The following trends, in particular, have emerged. • The number of incidents is stabilising, between 150 and 170 annually over the 2017–2022 period. • Human errors continue to decrease in terms user hours lost. • Malicious actions continue to constitute a minority of incidents: over the reporting period, the frequency of malicious actions was stable, accounting for approximately 5 % of incidents per year on average.

text: National authorities for telecom security continue to focus on the transposition and the implementation of the EECC, which brings the following changes. • The incident-reporting requirements in Article 40 of the EECC have a broader scope, explicitly including, for example, breaches of confidentiality. • In addition, the arrival of the network and information security directive (NIS2) in 2022 has consolidated the reporting of breaches of integrity, availability… across multiple sectors including – but not limited to the EECC – as of 17.10.2024.

text: ENISA will continue to work with national authorities through the European competent authorities for secure electronic communications ( ) working group and the NIS Cooperation

text: TELECOM SECURITY INCIDENTS 2022

text: group to find and exploit synergies between various pieces of EU legislation, particularly when it comes to incident reporting and cross-border

text: TELECOM SECURITY INCIDENTS 2022

text: 1. INTRODUCTION

text: Electronic communication providers in the EU have to report security incidents that have a significant ( ) impact on the continuity of electronic communication services to the national telecom regulatory authorities (NRAs) in each EU Member State. Every year the NRAs provide This is the annual ENISA with a summary of the most significant incidents based on a set of agreed EU-wide ENISA report on thresholds. This document, Telecom Security Incidents Report 2022, aggregates the 155 Incident Reporting incident reports received in 2022 and provides an overview of telecom security incidents in the for the telecom EU. sector.

text: The European Electronic Communications Code ( ) (EECC), includes a broader scope on the Mandatory incident requirements for incident reporting in

text: Article 40

text: and requires mandatory incident reporting with a reporting has been a specific focus on security incidents with a significant impact on the functioning of each category part of the EU’s of telecommunication services. telecom regulatory framework since Over the years, the regulatory authorities (Art. 41 EECC) have agreed to focus on 2009. network/service outages. This year, ENISA also received five reports of incidents related to breaches of confidentiality, one incident report received concerning the impact on redundancy Article 40 of the and one incident report concerning a near-miss incident. European Electronic Communications In 2022 ( ), a total of 155 incidents were reported. Code is the legal basis for this This document is structured as follows: document.

text: • in Section 2, the policy context and background are provided; • in Section 3, key facts and statistics about incidents in 2022 are provided; • in Section 4, we take a closer look at faulty software changes; and • in Section 5, a summary of multiannual trends over the 2012–2022 decade is provided.

text: TELECOM SECURITY INCIDENTS 2022

text: 2. BACKGROUND AND CONTEXT

text: In this chapter, the policy context is explained, along with the main features of the incident reporting process, as described in ENISA Technical Guideline on Incident Reporting ( ), which was developed in collaboration with national authorities.

text: 2.1 POLICY CONTEXT

text: By the end of 2020, the EECC came into effect across the EU. The year 2022 saw progress in its implementation ( ) by Member States.

text: Under Article 40 of the EECC the incident-reporting requirements have a broad scope, including not only outages but also breaches of confidentiality. In addition, there are more services included: not only traditional telecom operators, but also over-the-top OTT providers of communications services ( ), for example messaging services like Viber and WhatsApp and number-based interpersonal communications services and/or number-independent interpersonal communications services ( ).

text: The years 2020 and 2021 were characterised by the COVID-19 pandemic, which radically transformed the way people around the world live and work, driving towards more digitization. The year 2022 was then shaken by the Russian war of aggression against Ukraine and the numerous disruptions in telecommunications network and services like.

text: 2.2 INCIDENT REPORTING FRAMEWORK

text: There are three types of incident reporting: • national incident reporting from providers to NRAs; • ad hoc incident reporting between NRAs and ENISA; and • annual summary reporting from national authorities to the European Commission and ENISA.

text: It bears noting that in this setup ENISA acts as a collection point, anonymising, aggregating and analysing the incident reports. In the current setup, NRAs can search for incidents in the reporting tool (CIRAS), but the incident reports themselves do not refer to countries or providers, making the overall summary reporting process less sensitive to telecommunications providers.

text: The different types of reporting are shown in Figure 4.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 4: Incident reporting under Article 40 of the EECC

text: 2.3 INCIDENT REPORTING TOOL

text: ENISA maintains an incident reporting tool, CIRAS, for the authorities to upload reports and search for and study specific incidents.

text: For the general public, ENISA also has an online visual tool, which is publicly accessible and can be used for custom analysis of data. This tool anonymises the country or operator involved. Link: https://ciras.enisa.europa.eu/

text: The reporting template starts with the type of incident (choice between six types of cybersecurity incidents, explained in Figure 5). The field contains three parts: • impact of the incident: communication services impacted and by how much; • nature of the incident: the cause of the incident; • details of the incident: detailed information about the incident, including a short description, the types of network, the types of assets, the severity level, etc.

text: CIRAS is a free online tool where ENISA stores reported incidents and provides annual and multiannual statistics. TELECOM SECURITY INCIDENTS 2022

text: Figure 5: Types of cybersecurity incidents

text: • Type A. Service outage (e.g. continuity, availability). For example, an outage caused by a cable cut due to a mistake by the operator of an excavation machine used for building a new road would be categorised as a type A incident. • Type B. Other impact on service (e.g. confidentiality, authenticity, integrity). For example, a popular collaboration tool has not encrypted the content of the media channels, which are being established when a session is started, between the endpoints participating in the shared session. This leads to the interception of the media (voice, pictures, video, files, etc.) through a man-in-the-middle attack. This incident would be categorised as a type B incident. • Type C. Impact on other systems (e.g. ransomware in an office network, no impact on the service). For example, a malware being detected on several workstations and servers of the office network of a telecom provider would be categorised as a type C incident. • Type D. Threat or vulnerability (e.g. discovery of crypto flaw). For instance, the discovery of a cryptographic weakness would be categorised as a type D incident. • Type E. Impact on redundancy (e.g. failover or backup system). For example, one of two redundant submarine cables breaking would be categorised as a type E incident. • Type F. Near-miss incident (e.g. activation of security measures). For instance, a malicious attempt that ends up in the honeypot network of a telecom provider would be categorised as a type F incident.

text: For more information about the incident reporting process, please refer to: Technical Guideline on Incident Reporting under the EECC ( )

text: TELECOM SECURITY INCIDENTS 2022

text: 3. ANALYSIS OF INCIDENTS

text: For the year 2022, 26 EU Member States and two European Free Trade Association countries participated in the annual reporting process, reporting 155 significant incidents (compared to 168 in 2021 and 170 in 2020). In this section, the 155 reported incidents are aggregated and analysed. First, the impact on each root cause category is analysed in Section 3.1. 155 telecom In Section 3.2, the focus is on the user hours that were lost in each root cause category. security Detailed causes are then examined in Section 3.3, and in Section 3.4 the impact on each incidents service is analysed.

text: reported in

text: This year, ENISA also received five reports of incidents related to breaches of confidentiality,

text: 2022 by EU

text: one incident report concerning the impact on redundancy and one incident report concerning a

text: Member

text: near-miss incident.

text: States. 3.1 CATEGORIES OF ROOT CAUSES OF INCIDENTS

text: In 2022, there was a rise in incidents related to system failures, reaching 72 % despite a slight decrease in the number of incidents. In 2021, 59 % of telecom incidents were marked as system failures, against 61 % in 2020.

text: Human errors consistently rank second after system failures, with 15 %, when in 2021 it was 23 % (compared to 26 % in 2020).

text: Malicious actions accounted for 6 % of incidents in 2022, a slight decrease compared to 2021 (8 %), which was double the share of 2020 (4 %).

text: Natural phenomena decreased to 6 % from 10 % in 2021 and from 9 % in 2020.

text: Figure 6: Root cause categories – Telecom security incidents in 2022

text: TELECOM SECURITY INCIDENTS 2022

text: In 2022, incidents flagged as failures by third parties represented 23 % of incidents, with a total of 35 incident reports, compared to 22 % in 2021, 29 % in 2020 and 32 % in 2019. Four of them originated from human errors, three from malicious actions and one from natural phenomena, while the majority of them were related to system failures (see Figure 7).

text: Figure 7: Root cause categories – Telecom security incidents in 2022 (third-party failures)

text: 3.2 USER HOURS LOST IN EACH CATEGORY OF ROOT CAUSES

text: • System failures continue to largely dominate in terms of impact, reaching 72 % of incidents in 2022. They accounted for 10 481 million user hours lost compared to 363 million user hours in 2021 and 419 million in 2020. Among 8 527 million hours out of the 10 481 million were due to faulty software changes/updates. Another 1 048 million hours were due to power cuts. • Human error incidents steadily have decreased since 2020: from 26 % in 2020 to 23 % in 2021 and 15 % in 2022. Human error accounts for 135 million of user hours lost in 2022. • Malicious actions constitute a minority of total user hours lost with a percentage of 6% in 2022. However the number of user hours lost increased drastically, reaching 425 million in 2022 compared to 70 million in 2021. • User hours lost due to natural phenomena reached a record high in 2022, at 168 million, compared to 41 million in 2021 and 58 million in 2019; they accounted for 6 % of the total number of incidents.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 8: Share of user hours lost for each root cause category, 2022

text: 3.3 DETAILED ROOT CAUSES AND USER HOURS LOST

text: Detailed causes for all incidents are tracked, in addition to root cause categories in Figure 9. An incident is often a chain of events. For instance, an incident may be triggered by a storm, which tears down power supply infrastructure, cutting cables and thus power, which in turn results in a telecom outage. In this example, the root cause of the incident would be natural phenomenon and the detailed causes would be: heavy wind, cable cut, power cut and battery depletion. The most frequent detailed cause appearing in incident reports for 2022 is hardware failure followed by software bugs, power cuts and faulty software changes/updates.

text: Figure 9: Detailed root causes – Telecom security incidents in 2022

text: TELECOM SECURITY INCIDENTS 2022 3.3.1 Breakdown of root causes

text: What follows is an overview of detailed causes and user hours lost for each category of incident in an effort to provide clarity and transparency for specific root causes, which differ significantly between categories of incidents.

text: Figure 10 shows the frequency of detailed causes across incident reports for 2022 and the corresponding lost user hours.

text: Figure 10: Root causes of incidents v user hours lost – Telecom security incidents in 2022

text: 3.3.2 Breakdown of system failures

text: System failures counted for 111 incidents reports, meaning 72 % of total incidents for 10 481 million user hours lost.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 11: Root causes of system failure incidents vs user hours lost – Telecom security incidents in 2022 (system failures)

text: 3.3.3 Breakdown of human errors

text: Human errors counted for 23 incidents and 15 % of total incidents for 135 million user hours lost. Figure 12.a: Technical causes – Telecom security incidents in 2022 (human errors)

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 12.b: Root causes of human error incidents vs user hours lost – Telecom security incidents in 2022 (human errors)

text: 3.3.4 Breakdown of natural phenomena

text: Natural phenomena accounted for 10 incidents and 6 % of total incidents for 168 million user hours lost. Figure 13: Root causes of natural phenomena incidents vs user hours lost – Telecom security incidents in 2022 (natural phenomena)

text: a)

text: TELECOM SECURITY INCIDENTS 2022 3.3.5 Breakdown of malicious actions

text: Malicious actions counted for 10 incidents and 6 % of total incidents, for 425 million user hours lost, mainly due to DDoS attacks and other reasons ( ). In 2022, five DDoS incidents were reported, resulting in 1 million user hours lost.

text: Figure 14: Root causes of malicious action incidents v user hours lost – Telecom security incidents in 2022 (malicious actions)

text: TELECOM SECURITY INCIDENTS 2022 3.4 SERVICES AFFECTED

text: Figure 15 examines the services affected by incidents – from mobile and internet telephony, fixed internet and telephony, broadcasting and OTT services according to EECC-type services. Figure 15: Services affected ( ) – Telecom security incidents in 2022

text: Again, most of the reported incidents affected mobile services. In 2022, around 52 % of reported incidents had an impact on mobile telephony and internet in the EU, while fixed telephony continued to decline. Mobile internet followed, with around 40 % in 2022 – almost the same percentage as in 2021. Reported incidents affecting OTT services ( ) rose to 26 % of all reported incidents in 2022.

text: TELECOM SECURITY INCIDENTS 2022 3.5 TECHNICAL ASSETS AFFECTED

text: Each incident report also describes the (secondary) assets affected during the incident. Figure 16 shows the assets most affected. ‘Other’ means that detailed information was not provided. In the future, more information will need to be provided by Member States to improve the analysis of incidents. Incidentally, reassessing the asset taxonomy will also be needed to improve incident reporting.

text: Figure 16: Assets affected – Telecom security incidents 2022

text: TELECOM SECURITY INCIDENTS 2022

text: 4. DEEP-DIVE ANALYSIS OF THE TECHNICAL CAUSES OF INCIDENTS

text: This section contains an in-depth review of the most high-profile technical causes behind reported incidents, focusing not only on 2022 but also on previous years.

text: 4.1 HARDWARE FAILURES

text: In 2022, 36 incidents (23 % of total) were marked as hardware failures; they resulted in 797 million user hours lost, as seen in Figure 17. All of them were reported as system failures. Figure 17: Incidents with hardware failure as the root cause – Telecom security incidents in the EU in 2022

text: 4.2 SOFTWARE BUGS

text: In 2022, 32 incidents (20 % of total) were marked as being due to software bugs; they resulted in 92 million user hours lost, as can be seen in Figure 18. compared to 216 million in 2021. All but one of them were reported as system failures, with one incident being reported as due to human error.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 18: Incidents having software bugs as the root cause – Telecom security incidents in the EU in 2022

text: 4.3 FAULTY SOFTWARE CHANGES/UPDATES

text: In 2022, 12 % of total incidents (19 incidents) were marked as being due to faulty software changes or updates, resulting in a staggering 8 634 million user hours lost, as can be seen in Figure 19. Among them, seven incidents were due to human errors, accounting for 107 million user hours lost.

text: Figure 19: Incidents having faulty software changes/updates as the root cause –Telecom security incidents in the EU in 2022

text: TELECOM SECURITY INCIDENTS 2022

text: 5. MULTIANNUAL TRENDS

text: ENISA has been collecting and aggregating incident reports since 2012. In this section, we present multiannual trends over the last 11 years, from 2012 to 2022. This dataset contains 1 586 reported incidents in total, as we can see in Figure 20. Over the course of the last 5 years, the number of incidents has been stabilising at around the 160/year mark, meaning an average of one incident every 2 days.

text: Figure 20: Number of incidents reported per year (2012–2022)

text: 5.1 MULTIANNUAL TRENDS – CATEGORIES OF ROOT CAUSES

text: Every year, from 2012 to 2022, system failures were the most common root cause. In 2022, the share of system failures remained stable, continuing the trend first observed in 2020 as seen in Figure 21.

text: Figure 21: Root cause categories – Telecom security incidents in the EU reported over 2012–2022

text: In total, system failures accounted for 1 036 incident reports (66 % of the total). For this root cause category, over the last 11 years, the most common causes for system failures were hardware failures (34 %) and software bugs (27 %). The second most common root cause over

text: TELECOM SECURITY INCIDENTS 2022

text: the 11 years of reporting was human errors, with nearly a fifth of total incidents (20 %, 309 incidents in total). Natural phenomena come third, at almost a tenth of total incidents (9 %, 149 incidents in total).

text: Only 5 % of incidents have been categorised as malicious actions, with 83 incidents over the course of 11 years. In the 2012–2022 period, nearly two thirds of malicious actions consisted of denial-of-service attacks (62 %), while the remainder were mainly comprised of lasting damage to physical infrastructure, for example cable cuts and arson. Only 3 % was attributed to malware and viruses, as shown in Figure 22. Incidentally, 28 % of technical causes are being classified as ‘other’. This highlights the need to update the taxonomy of malicious actions – something that the NIS2 report has underlines as well.

text: Figure 22: Technical causes for incidents due to malicious actions – Telecom security incidents in the EU reported over 2012–2022

text: Interestingly, the assets affected by malicious actions differ significantly from the overall categorisation of affected assets. Addressing servers came first, with 23 %, followed by switches and routers, at 19 %, as seen in Figure 23.

text: TELECOM SECURITY INCIDENTS 2022

text: Moreover, with respect to services affected by malicious actions, 59 % referred to fixed internet and 40 % to mobile internet services, whereas 4 % referred to OTT services.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 24: Services affected by incidents due to malicious actions – Telecom security incidents in the EU reported over 2012–2022

text: 5.2 MULTIANNUAL TRENDS – IMPACT ON EACH SERVICE

text: Over the period, mobile internet and mobile telephony were once more the most impacted by incidents (44 % and 47 %, respectively). The first one remained stable, when the second pursued its decrease. Fixed internet decreased to 27 %, while fixed telephony services decreased to 33 %. The increase in broadcast-related incidents has persisted since 2020. Since 2021, reporting of incidents related to OTT communication services has been organised.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 25: Trends on impact for each service reported over 2012–2022

text: 5.3 MULTIANNUAL TRENDS – USER HOURS FOR EACH ROOT CAUSE

text: In terms of overall impact, as indicated in Figure 26, system failures traditionally rank high in terms of user hours lost. After a peak in 2020, the impact of human errors is steadily decreasing. The overall impact of natural phenomena has been trending downward over the last 3 years, while the impact of malicious actions is steadily rising, reaching 508 million user hours lost since 2020, after 3 years.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 26: User hours lost for each category of root causes, 2012–2022

text: 5.4 MULTIANNUAL TRENDS FOR SEVERITY OF IMPACT OF INCIDENTS

text: ENISA has published technical guidelines on incident reporting under the EECC ( ), including on thresholds, severity estimation and calculating hours lost. Since 2017, a noteworthy and constant decrease in reports of extremely severe incidents was observed, slightly halted in 2022. Conversely, there has been a steady increase in minor and large incidents since 2019.

text: These findings point, on the one hand, to the growing maturity of electronic communication providers with respect to the incident reporting process and, on the other hand, to the improvement of resilience and the provision of security services (including incident reporting itself) that has led to a lower number of very large severe incidents.

text: Relevant multiannual trends may be found in Figure 27.

text: TELECOM SECURITY INCIDENTS 2022

text: Figure 27: Severity of impact for each year – multiannual trends 2012–2022 (number of incidents)

text: 5.5 MULTIANNUAL TRENDS FOR THE NUMBER OF INCIDENTS AND USER HOURS LOST

text: Over the years, the number of incidents has increased steadily and is now stabilising at around 150–170 a year. Precisely, in 2022 data were as follows: 155 incidents for 11 216 million hours lost.

text: TELECOM SECURITY INCIDENTS 2022

text: 6. CONCLUSIONS

text: The present document covers the incidents reported by the authorities for the calendar year 2022 and gives an anonymised, aggregated EU-wide overview of telecom security incidents. It marks the 11th time ENISA has published an annual report for the telecom sector. To conclude, here are the main findings and some general observations about this process and the broader policy context.

text: Main findings

text: Reporting of incidents shows the following.

text: • Mobile telephony and mobile internet were the most impacted sectors, with respectively 52 % and 40 % of incidents. • OTT services accounted for 26 % of incidents. • Traditional fixed telephony, fixed internet and broadcasting services continued to drop in terms of reports. • System failures continued to largely dominate in terms of impact, reaching 72 % in 2022. They globally accounted for 10 481 million user hours lost (against 10 025 million for OTT) compared to 363 in 2021 and 419 million user hours in 2020. In 2022, 36 incidents (23 % of total) were marked as hardware failures. They resulted in 797 million user hours lost compared to 53 million in 2021. All of them were reported as system failures. • Human error incidents have steadily decreased since 2020, from 26 % in 2020 to 23 % in 2021 and 15 % in 2022. Human error accounts for 135 million user hours lost in 2022. • Malicious actions slowed down their progression in 2022, at 6 % of total incidents. In 2020, incidents marked as malicious actions represented 4 % of the total, a number which rose to 8 % in 2021. However, they accounted for 435 million of user hours lost in 2022, compared to 70 million in 2021 and 13 million in 2020. • In 2022, five distributed denial-of-service incidents were reported, resulting in 1 million user hours lost. • The share of incidents due to natural phenomena remained stable, at 6 %. However, the number of user hours lost increased. • In 2022, incidents flagged as failures by third parties represented 23 % of incidents, with a total of 35 incident reports compared to 22 % in 2021, 29 % in 2020 and 32 % in 2019. Four of them originated from human errors, three from malicious actions and one from natural phenomena. • Five incidents concerning confidentiality and authenticity were reported, compared to three in 2021. • One incident concerning impact on redundancy was reported for the first time. • One incident concerning a near-miss incident was reported for the first time.

text: General observations

text: • In the coming months, national authorities for telecom security will continue to focus on the transposition and the implementation of the EECC, which will bring the following changes. • The incident reporting requirements in Article 40 of the EECC have a broader scope, explicitly including, for example, breaches of confidentiality. • In addition, the arrival of the NIS2 directive in 2022 will consolidate the reporting of security breaches across multiple sectors including – but not limited to – the EECC as of 17.10.2024. • In 2023 and 2024, ENISA will continue to work with national authorities through the ECASEC working group as well as the NIS Cooperation group to find and exploit synergies between different pieces of EU legislation, particularly when it comes to incident reporting and crossborder supervision. • ENISA will also pursue the work with national authorities and regulators on how to implement the consolidated reporting of incidents under the NIS2 directive, since it brings significant

text: TELECOM SECURITY INCIDENTS 2022

text: changes to security incident reporting in the EU by consolidating all relevant streams under the NIS2 umbrella, namely consolidating incident reporting under the EECC, NIS2 and electronic identification, authentication and trust services (eiDAS) regulations, among others. • Additionally, it is worth noting that many smaller-scale incidents, however frequent, remain under the radar. Some of these incidents, such as targeted DDoS, SIM-swapping and SS7 attacks, can still have major impacts on individual customers. In coming years, this area needs to be analysed better with the possible introduction of a summary reporting format for these smaller-scale incidents. • The CIRAS methodology and guidelines may also be reviewed during our regular discussions to better reflect new developments and to facilitate reporting and alleviate the administrative burden.

text: ENISA looks forward to continuing its close collaboration with EU Member States, the NRAs and experts from the telecom sector from across Europe to implement security incident reporting efficiently and effectively, and takes the opportunity to thank all the contributors of this report

text: -N -EN -167 -24 -09 TP

text: ABOUT ENISA

text: ISBN: 978-92-9204-668-2 DOI: 10.2824/902186