Czech Railways (ČD) & Railway Administration hit by cyberattack; operations impacted, safety not compromised

In late March 2021, the computer systems of two Czech state rail bodies, the Railway Administration (Správa železnic) and the national passenger carrier Czech Railways (České dráhy), were hit by a cyberattack. According to reporting, the Railway Administration began facing the threat on Friday 19 March 2021, with the incident becoming public and being addressed in the days that followed. Both organisations stressed that the intrusion affected IT systems only and did not compromise rail operations or safety; the Railway Administration stated the situation did not threaten or reduce the safety of rail transport, and Czech Railways said railway operations were not and would not be endangered.

Management declined to disclose technical specifics, citing the ongoing investigation. The Czech National Cyber and Information Security Agency (NÚKIB) was promptly notified and involved. At the time, NÚKIB had ordered organisations subject to the cybersecurity act to urgently patch Microsoft Exchange Server installations against then-recently disclosed vulnerabilities, though it was not confirmed whether that flaw was the vector in the railway case. Reporting indicates other Czech institutions were targeted around the same period. The attackers' identity and motive were not established, and no specific actor or state was officially blamed.

The verified facts are limited but consistent across Czech sources: an IT-systems breach affecting two state rail operators in March 2021, with no demonstrated impact on operational or track safety. Attribution remains unknown, no actor was officially identified, and the contemporaneous Microsoft Exchange patching directive is suggestive of context rather than proof of vector. The incident illustrates the rail sector's exposure to cyber risk and the recurring pattern of administrative/IT compromise being contained short of safety-critical operational systems. Claims linking it to any state should be treated as unsupported absent further evidence.