Get Quartz in your inbox

Free daily briefing on global business news.

10 major cyberattacks of the 21st century, from Estonia to Colonial Pipeline

These 10 major cyberattacks of the 21st century, from Estonia in 2007 to Colonial Pipeline in 2021, show how digital attacks came to disrupt governments, hospitals, banks and pipelines

In April and May 2007, floods of junk traffic knocked Estonian government, bank and media websites offline. In May 2021, a ransomware attack led Colonial Pipeline to shut down its fuel pipeline operations in the U.S. Between those two events, digital attacks moved off the screen and into the physical economy.

Over that stretch, malicious code damaged uranium centrifuges in Iran. Thieves used fraudulent SWIFT messages to move about $81 million from Bangladesh Bank's account at the Federal Reserve Bank of New York to accounts in the Philippines. Ransomware severely disrupted the U.K.'s National Health Service. Malware hidden in updates to a Ukrainian accounting program spread worldwide and damaged operations at shipping company Maersk and drugmaker Merck $MRK. Yahoo said in 2017 that all 3 billion of its user accounts had been affected by a breach dating to 2013.

This list collects 10 major cyberattacks of the 21st century in chronological order, from Estonia in 2007 to Colonial Pipeline in 2021. It is a selection, not a ranking. The slides do not rank these attacks by cost.

The events also cover several of the common forms a cyberattack takes. They include distributed denial-of-service floods, sabotage malware aimed at industrial control systems, mass data breaches and fraudulent payment orders. They also include botnets built from hijacked cameras and routers, self-spreading ransomware and supply chain attacks that hide malicious code inside trusted software updates.

Attribution runs through the list as well. The FBI publicly blamed North Korea for the 2014 Sony $SONY Pictures hack. U.S. authorities attributed the Bangladesh Bank heist to North Korea's Lazarus Group. The U.S. and U.K. governments attributed WannaCry to North Korea and NotPetya to Russia's military. The U.S. government tied the SolarWinds compromise to Russia's foreign intelligence service, the SVR. Other cases remain less settled. Who directed the Estonia attacks has been debated. The U.S. and Israel were widely reported to be behind Stuxnet, but neither government formally confirmed it.

Each slide stands on its own. It explains what happened, how the attack worked, what it hit and which government, if any, publicly named a culprit.

Estonia cyberattacks of 2007 over a Soviet-era war memorial

In April and May 2007, distributed denial-of-service attacks hit Estonian government, bank and media websites. They followed a dispute over moving a Soviet-era war memorial in Tallinn. The episode is widely cited as the first attack of this scale on a country's digital infrastructure.

A distributed denial-of-service attack, usually shortened to DDoS, does not break into a system or steal data. It sends a target more traffic than its servers or network connections can absorb. Ordinary visitors then find the site slow to load or unreachable.

The word "distributed" describes where the traffic comes from. The requests arrive from many machines at once rather than from one source. With no single address to block, the flood is harder to stop. Attackers often rely on botnets — networks of compromised computers that are controlled remotely without their owners' knowledge.

The Estonian attacks did not stop at a single agency. Government sites, banks and news outlets were targeted during the same weeks. That breadth set the episode apart from an isolated website outage. People in one country could face trouble reaching official information, financial services and the news at the same time.

The motive was political rather than financial. The attacks carried no ransom demand, and a DDoS flood does not take money or files. Their timing tied an argument over history and public symbols to disruption online.

Responsibility for directing the attacks has been disputed. Public accounts have not settled on a single party behind them.

A DDoS attack also leaves a different kind of damage than malware does. When the flood of traffic ends, the affected sites can come back. No systems are encrypted or wiped, and no stolen records need to be traced. The harm is the loss of access while the attack continues.

That temporary form of harm separates the 2007 episode from several later attacks, which moved toward physical sabotage, mass data theft and ransomware. Estonia remains an early example of a political dispute spilling over into an attack on a nation's online services.

Stuxnet worm sabotage of Iran's Natanz uranium centrifuges

Stuxnet, a computer worm discovered in 2010, damaged centrifuges at Iran's Natanz uranium enrichment facility. It worked by targeting Siemens software used in industrial control systems. The result was malicious code built to break physical machinery.

Most malware is designed to steal information, extort money or knock services offline. Stuxnet had a narrower goal. Its real target was the equipment that industrial control systems manage, not the files stored on ordinary office computers.

Industrial control systems are the computers and software that run physical processes. Factories, power plants, water treatment sites and nuclear facilities rely on them to start, stop and regulate machines. Operators depend on that control layer to keep equipment running within safe limits.

A centrifuge used in uranium enrichment spins at high speed to separate isotopes of uranium. Enrichment raises the share of the isotope that sustains a nuclear chain reaction. Low-enriched uranium can fuel nuclear power reactors. Highly enriched uranium can be used in nuclear weapons. That dual use is why enrichment sites draw close international scrutiny.

Stuxnet moved through computers running Microsoft $MSFT Windows. Windows machines are common in industrial settings, where engineers use them to program and monitor control........

© Quartz