Hackers attack firemen's database and access personal data

A database of the National Census of Portuguese Firefighters (RNBP) was the target of a cyber attack and pirates accessed personal data, which led to a civil protection alert to the commands and suspension of the application.

In the communication to all regional and responsible commands of the autonomous regions of the Azores and Madeira, to which Lusa had access, the National Emergency and Civil Protection Authority (ANEPC), which manages the GNIP platform, admits the attack and says that a copy of the data was made.

Among the personal data are the full name of the registered firefighters, citizen card numbers, tax identification, social security, health care user (and health subsystems), driving licence, marital status, date of birth, contacts, addresses, image and blood group, the document says.

Contacted by Lusa, the Portuguese Firefighters League (LBP) confirmed the situation, admitting that the information should have followed individually for each of the elements registered in the GNIP.

António Nunes, president of LPB, explained that the application of the GNIP has personal data, but does not have bank data and said not yet have information about whether there was effective ability to collect data.

But in the information that ANEPC sent to the regional commands, to which Lusa had access, the access and copy of the data is clear, as well as the suspension of the GNIP application.

“The database of the National Fire Department (RNBP), was the subject of a cyber attack, and it was possible to make a copy of the personal data,” says the information, adding that the ANEPC, the National Cyber Security Center (CNCS) and the National Internal Security Network (RNSI) have “immediately suspended the application.”.

It also says that additional security systems are being developed to ensure the protection of the personal data contained in the application.

In the same alert, Civil Protection explains that, as a result of this personal data breach, data subjects may be the target of ‘phishing’ (messages that simulate legitimate communications to attract malicious clicks and links and attachments), ‘smishing’ (tempts of SMS or MMS fraud) or ‘vishing’ (frauds by telephone call).

They may also be the target of ‘quishing’ actions, a fraud scheme that uses malicious QR codes to redirect victims to fake websites.

As security measures, the ANEPC requests “redoubled attention” for calls and/or messages that request links or websites openings.

The GNIP is the system of information and management of the registration of Portuguese firefighters, the command boards, active, reserve and honor.

According to António Nunes, the application has about 60,000 records.

Lusa contacted ANEPC and CNCS to try to clarify the measures that are being developed, but has not been answered so far.