Vanuatu Government Systems Stayed Offline for Weeks as Officials Used Personal Email

Vanuatu’s government servers were reported taken out on 4 November 2022, with the government broadband network confirmed compromised from 6 November. Reporting traces the start to suspicious phishing activity in email directed at the Ministry of Finance.

Email, network shares, VoIP and other online services went down across ministries and departments. Emergency services, email and phone lines were affected for weeks. Staff at Port Vila Central, the main hospital, used pen and paper into late November. By early December around 70% of the network was reported restored, and more than a month after the attack many officials were still conducting business from personal email accounts.

We filed Costa Rica at 22-0508, where a state met a ransomware campaign by declaring a national emergency and invoking the powers that come with it.

Vanuatu is the same category of event with none of that apparatus. A small state lost its administrative capacity for weeks and the response was recovery work, quietly, over a month. Both are what national-scale availability harm looks like; only one produced an instrument anyone can point at afterwards.

Officials moved to personal email to keep the state running. That was the correct decision — the alternative was for government to stop — and it means a month of government correspondence sat in consumer mailboxes with no retention policy, no records management and no institutional control.

We have recorded degraded-mode operation as the realistic posture at 26-0728 and 22-1002, where a hospital system ran on paper. This file records its cost: the fallback creates exposure that outlives the outage, and nobody counts that either.

By record count this incident is invisible. No figure for affected individuals was published, no notification letters were sent, and no regulator produced a finding.

What was lost was a national government’s ability to function, for a population of a few hundred thousand people who have one. We have argued at 24-1231 that availability harm goes uncounted; the corollary this file adds is that small jurisdictions are undercounted twice, because the absolute numbers never look large enough to report.