The information extracted may include names, dates and places of birth, details of family members, health insurance, social benefits, pensions, disabilities, driving licences, vehicles, and companies owned or managed. Financial data may also have been extracted, including IBANs, tax liabilities and MPay payment history. Not all data subjects had all these categories of data exposed.
After the attack was detected, the e-Government Agency (AGE) ordered a review of 82 digital services. To prevent unauthorised access, vulnerable services were temporarily suspended, along with over 30 information systems and administration panels.
On 25 October, specialists blocked a further attempt at unauthorised access, and on 27 October, other attempts to extract data were thwarted. Most of the affected services have already been restored, and the remainder will be brought back online once security has been reconfirmed.
Bank card details were not affected
The authorities state that bank card data has not been compromised and that investigations have not identified any unauthorised changes to state registers. Knowing an IBAN does not, in itself, allow access to a bank account or enable unauthorised transfers to be made.
According to preliminary data, the attackers exploited vulnerabilities in certain services accessible without authentication. Due to the incorrect recording of the legal basis for data processing, users of the EVO app were able to see, in their access history, transactions associated with requests for civil status documents or the renewal of driving licences.
The Cyber Security Agency (ASC), the Information Technology and Cyber Security Service (STISC), the Information and Security Service (SIS), the National Centre for the Protection of Personal Data and the police are all involved in investigating the incident.
The authorities warn that the information extracted could be used in fraud attempts. Citizens are urged not to disclose passwords or authentication codes, not to click on suspicious links, and to verify any unusual requests by contacting banks or public institutions directly through official channels.
The scale of the incident is to be determined as part of the investigation and a comprehensive audit of government information systems.
This story was translated with the assistance of artificial intelligence.The translation was also reviewed by the Logos Press editorial team.
Follow our updates
Have information for the newsroom? Share it with Logos-Press
Comments
0No comments yet. You can start the conversation.
Comments are open to readers with a Logos Press account.
Sign in to comment