# Baltic public cyber incidents and management liability cases URL: https://insurancelawestonia.ee/specialty-lines/handbook/cases/baltic-incidents/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-10 > Publicly known cyber incidents and management liability cases in Estonia, Latvia and Lithuania as neutral facts, and the insurance law questions. > **In short.** The Baltic states have seen both large-scale cyberattacks and management liability cases that illustrate the risks faced by businesses in the region. On this page we set out only publicly known, neutral facts, each with its source. **We do not know, and do not speculate, whether the organisations named had an insurance contract, what it covered or whether an insurer indemnified the loss, and we do not assess anyone's conduct.** Each case is followed by a general description of the insurance law questions that a similar event would raise in any company.[^1] ## A. Cyber incidents ### 1. The 2007 cyberattacks on Estonia **Public facts.** In April and May 2007 Estonia was hit by coordinated denial-of-service attacks that disrupted the e-services of state institutions, banks and media outlets. The attacks took place in a politically tense situation.[^2] **Questions a similar event raises.** In a denial-of-service attack the main loss is business interruption and recovery costs; there may be no data breach at all. If the attack has a political background, the question arises whether the war exclusion and the cyber operation exclusion apply, and who proves the attribution of the attack to a state, and how. Under a cyber policy it must be checked whether denial of service is covered even where the systems are not damaged, and what the waiting period for business interruption is. See [War exclusions and cyber insurance under Estonian law](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber). ### 2. Ransomware at a dental clinic (Estonia, 2024) **Public facts.** According to the November 2024 situation overview of the Information System Authority (*Riigi Infosüsteemi Amet*, RIA), on 1 November ransomware encrypted the data on a dental clinic's server. The clinic had no working backup, so the data could not be restored.[^3] **Questions a similar event raises.** For a healthcare provider, the loss of health data is a personal data breach that must be notified to the Data Protection Inspectorate (*Andmekaitse Inspektsioon*) under Article 33 of the General Data Protection Regulation, and it creates a risk to the continuity of care.[^4] The questions that arise under the insurance contract are whether the costs of restoring and re-collecting the data are covered, whether the policy makes a working backup a prerequisite (an obligation of the policyholder under the Law of Obligations Act (*võlaõigusseadus*, VÕS) § 452 lg 2), and whether the existence of a backup was confirmed in the proposal (VÕS §§ 440–442).[^5] ### 3. Killnet denial-of-service attacks in Lithuania (2022) **Public facts.** In June 2022 the e-services of Lithuanian state institutions and companies were hit by denial-of-service attacks for which the pro-Russian hacker group Killnet claimed responsibility. According to Killnet itself, the attacks were a response to Lithuania's restrictions on the transit to Kaliningrad of goods subject to sanctions.[^6] **Questions a similar event raises.** The political motive of an attack and a group's public claim of responsibility do not in themselves mean that the attack is a state cyber operation within the meaning of an exclusion. It depends on the policy wording whether the exclusion requires action by a state or action on behalf of a state, or whether a mere "connection" is sufficient. ### 4. Killnet attack on Latvian public service media **Public facts.** According to press reports, in July 2022 Killnet hit Latvia with one of the largest waves of cyberattacks in the country's history, including a 12-hour attack on its public broadcasting centre. The group relies mainly on distributed denial-of-service (DDoS) attacks and website defacement.[^7] **Questions a similar event raises.** For a media or service company, the main risks are the unavailability of the service and reputational harm. The business interruption cover of a cyber policy must also extend to a partial degradation of the service. ## B. Management liability cases ### 5. The Estonian branch of Danske Bank **Public facts.** Between 2007 and 2015, payments of about EUR 200 billion in total passed through the Estonian branch of Danske Bank for the roughly 15,000 customers with non-resident characteristics covered by the bank's internal investigation. The investigation did not classify that whole amount as suspicious, let alone as proven money laundering: it found that most of the customers analysed had suspicious characteristics and expected a significant part of the payments to be suspicious, while stressing that a suspicious customer does not make all of that customer's payments suspicious. The total volume, the suspicious volume and proven money laundering are therefore different figures. The Estonian authorities required the branch to cease its operations in 2019. In December 2022 the bank pleaded guilty in proceedings brought by the US Department of Justice and agreed to pay about USD 2 billion.[^8] **Questions a similar event raises.** Shortcomings in anti-money laundering controls lead to supervisory proceedings in several countries, to investor claims and to the question of the directors' personal liability. Under D&O insurance it is central whether the policy covers the costs of a regulatory investigation, proceedings in several jurisdictions and defence costs before a final judgment, and how the exclusions for fines and for deliberate breaches are worded. ### 6. ABLV Bank (Latvia, 2018) **Public facts.** In February 2018 the US Treasury's Financial Crimes Enforcement Network (FinCEN) published allegations concerning the bank, including suspected money laundering. The European Central Bank announced that the bank would be wound up under Latvian law, and the bank's governing bodies decided to start a voluntary liquidation. In September 2024 FinCEN withdrew its finding and the related proposed rule.[^9] **Questions a similar event raises.** A finding by a foreign authority can end a company's business model within days. For the directors, the question is whether the D&O policy covers proceedings before a foreign authority and whether the territorial scope of the policy includes the United States. ### 7. Snoras (Lithuania, 2011) **Public facts.** In November 2011 the Bank of Lithuania (*Lietuvos bankas*) appointed a temporary administrator to the bank. The analysis showed that the bank's net assets were significantly smaller than its liabilities, and the Bank of Lithuania decided to apply for its bankruptcy.[^10] **Questions a similar event raises.** Claims against the directors of a bankrupt company are brought by the administrator and by the creditors. Because the company cannot indemnify its directors, the decisive factors are the directors' personal Side A cover and whether, after the bankruptcy, claims can still be made or reported under the policy, for example during an extended reporting period; such a period is a contractual window for claims arising from acts committed before it began, not a continuation of cover for new acts. ### 8. Port of Tallinn: civil claim against former directors (Estonia) **Public facts.** The state-owned port company and its subsidiary brought a civil claim against two former management board members who had been detained in 2015 and charged with large-scale corruption and money laundering.[^11] In the criminal case, the Tallinn Circuit Court terminated proceedings on part of the bribery episodes on 4 June 2025 because the absolute limitation period had expired, and the county court's acquittal on the money laundering charges remained in force ([court press release of 04.06.2025](https://www.kohus.ee/ru/node/74181)). According to the company's interim report for Q1 2026, the Supreme Court declined to accept the companies' cassation appeal on 2 February 2026, the judgments entered into force, and the companies filed a new civil action the same day against the former board members and other persons who caused the damage ([AS Tallinna Sadam, interim report Q1 2026, note 15](https://www.ts.ee/wp-content/uploads/2026/05/2026_Ikv_vahearuanne.pdf)). Filing an action does not establish that the claim is well founded. **Questions a similar event raises.** A company may itself claim damages from its former management board members. For a public limited company (*aktsiaselts*, AS) such as the port company, the basis is the Commercial Code (*äriseadustik*, ÄS) § 315, and for supervisory board members § 327; § 187 is the parallel rule for a private limited company (*osaühing*, OÜ). A creditor may claim the company's damage from a board member only if it cannot obtain satisfaction from the company's assets, and once the company has been declared bankrupt only the trustee may bring that claim on the company's behalf (ÄS § 315 lg 4).[^12] D&O policies usually contain an insured vs insured exclusion with exceptions. There is no cover for an intentional crime, but defence costs may be advanced until a final judgment. Lengthy proceedings call for an adequate extended reporting period and an adequate limit. ### 9. Rīgas Satiksme (Latvia, 2020) **Public facts.** In September 2020 the shareholders' meeting of the public transport company owned by the City of Riga approved the filing of a claim of at least EUR 1.5 million against four former management board members in connection with allegedly fictitious consultancy contracts.[^13] **Questions a similar event raises.** Publicly owned companies are not free of D&O risk. A claim may come years after the decisions were taken, so the retroactive date of the policy and notice of circumstances are important. ## C. General lessons for businesses in Estonia 1. **The geopolitical background is real in the Baltic region.** Politically motivated denial-of-service attacks have occurred here repeatedly. The wording of the war exclusion is a practical, not a theoretical, question for an Estonian business. 2. **A small organisation is not protected by its size.** The overviews of the Information System Authority show that ransomware also hits small businesses and healthcare providers, and that the absence of a backup makes the loss irreversible. 3. **Management liability materialises years later.** Claims against former directors are often brought after long criminal or supervisory proceedings. 4. **Multi-jurisdictional risk.** Cases in the financial sector have shown that action by a foreign authority can be decisive. ## D. The Estonian legal background in management liability cases If a similar case arose in an Estonian company, the following rules would be central. - **Duty of care and burden of proof.** A management board member is liable for damage caused to the company by a breach of duties; to be released from liability, the member must prove that he or she performed the duties with the diligence of a prudent businessperson (ÄS § 187; in a public limited company § 315; for supervisory board members § 327).[^12] - **Joint and several liability.** Management board members who have breached their duties are jointly and severally liable; for that reason they often also share the common limit of the D&O policy. - **Insolvency.** Where the insolvency is not temporary, the management board must file a bankruptcy petition without delay, and no later than within 20 days, and must not make payments that are inconsistent with the diligence of a prudent businessperson (ÄS § 180 lg 5¹).[^12] - **Cyber security.** Within the scope of the Cybersecurity Act (*küberturvalisuse seadus*, KüTS), a management board member responsible for cyber security must be designated (KüTS § 6¹).[^14] - **Intent.** In liability insurance, the insurer is not liable for damage that the policyholder caused intentionally and unlawfully (VÕS § 513).[^5] Estonian case law on the liability of management board members and on D&O insurance is discussed on the Estonian page [D&O-kaasused](https://kindlustusoigus.ee/kindlustusliigid/kahjukindlustus/do-kindlustus/kaasused/) (in Estonian). ## E. Questions every Baltic company could ask itself on the basis of these cases 1. Would the war exclusion in our cyber policy exclude a politically motivated denial-of-service attack? Who has to prove that the attack was the act of a state? 2. Is our backup separated from the main network, and has restoring from it been tested? 3. Do we know the deadlines for reporting an incident and the authorities to which we must report it? 4. Does our D&O policy cover proceedings before a foreign authority and the costs of a regulatory investigation? 5. Does the D&O cover continue if the company becomes insolvent, and are former directors covered? 6. Does the policy allow the company to claim damages from its former directors without the cover being lost (exceptions to the insured vs insured exclusion)? 7. Have we notified the insurer of circumstances that may lead to a claim in the future? ## Related pages - [Cyber insurance cases](https://insurancelawestonia.ee/specialty-lines/handbook/cases/cyber-insurance-cases) - [D&O insurance cases](https://insurancelawestonia.ee/specialty-lines/handbook/cases/d-and-o-cases) - [War exclusions and cyber insurance under Estonian law](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber) - [Cross-border payments, crypto-assets and jurisdiction](https://insurancelawestonia.ee/specialty-lines/handbook/cross-border-payments-crypto-jurisdiction) ## References [^1]: O.-J. Luik. Ettevõtte juhtkonna riskiraamat (Risk handbook for company management). Manuscript, version of 03.05.2026, ch 41.1 and 43. [^2]: 2007 cyberattacks on Estonia. Wikipedia. . [^3]: Information System Authority (Riigi Infosüsteemi Amet). Situation in cyberspace, November 2024. . [^4]: Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), art 33(1). . [^5]: Law of Obligations Act (võlaõigusseadus, VÕS) §§ 440–442, § 452 lg 2, § 513. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: . [^6]: Lithuania hit with "intensive" cyber attacks amid Kaliningrad row. LRT English, 27.06.2022. . [^7]: D. Antoniuk. Pro-Kremlin hackers target Latvia's parliament after declaring Russia a sponsor of terrorism. The Record, 11 August 2022. ; Quorum Cyber. Killnet Threat Actor Profile. ; O. Moody. Pro-Kremlin hackers Killnet hit Latvia with biggest cyberattack in its history. The Times, as reported by DataBreaches.net. . [^8]: Danske Bank money laundering scandal. Wikipedia. ; Finantsinspektsioon. Finantsinspektsioon has issued a precept requiring Danske Bank to terminate its activities in Estonia, 19.02.2019. ; U.S. Department of Justice. Danske Bank pleads guilty to fraud on U.S. banks in multi-billion dollar scheme to access the U.S. financial system. Press release, 13.12.2022. ; Danske Bank. Press release on the investigations into the non-resident portfolio at the Estonian branch, 19.09.2018. . [^9]: ABLV Bank. Wikipedia. ; FinCEN withdraws finding and notice of proposed rulemaking regarding ABLV Bank. FinCEN, 26.09.2024. . [^10]: Lietuvos bankas. The Bank of Lithuania revoked the licence of AB bankas Snoras and will apply to court regarding bankruptcy. . [^11]: TEGOS. Representing SOE Port of Tallinn against its former directors, 04.02.2019. . [^12]: Commercial Code (äriseadustik, ÄS) § 180 lg 5¹, §§ 187, 315, 327. RT I, 06.07.2023, 131 (in force 01.03.2024). Estonian: ; English: . [^13]: Rīgas dome (Riga City Council). LTD "Rīgas Satiksme" will file claim against former members of the board, 07.09.2020. . [^14]: Cybersecurity Act (küberturvalisuse seadus, KüTS) § 6¹. RT I, 06.10.2026, 2 (in force 16.10.2026). Estonian: ; English (version in force 01.10.2026–15.10.2026): .