Civil Protection confirms cyberattack and advises “redoubled attention”

A Civil Protection confirmed today the cyberattack and access to data from the national firemen recensing and says that procedures are under way to enhance the security of the application, while suspended.

In a statement released today, after the computer attack that allowed access to personal data from firefighters was released, the National Emergency and Civil Protection Authority (ANEPC) said that it sent an internal communication to the fire department owners and fire departments to report the situation and alert to possible fraud attempts.

In this communication – adds – “followed a set of procedures.”.

In the information sent to regional commandos, the ANEPC calls on firefighters to maintain “redoubled attention” with calls, messages or “other unexpected communications” requesting access to electronic links or pages, disclosure of personal data or filling out of forms.

In case of doubt, he says that firefighters should confirm the authenticity of communication with the command structure of the respective fire department, “through the usual channels”.

In its notice to the media in the meantime, the ANEPC clarifies that communications to firefighters, namely for updating data or transmitting information, “always favour institutional channels through the command structure of their respective fire departments.”.

It also says that it will continue to develop the necessary steps to enhance the security of its systems and the protection of personal data, maintaining as a priority the security of information and the confidence of firefighters in institutional communication channels.

According to information that Lusa had access to, this attack on the Portuguese Fire Department (RNBP) database allowed hackers to access personal data such as the full name of registered firefighters, citizen card numbers, tax identification, social security and health care (and health subsystems), driving license, marital status, date of birth, contacts, addresses, image and blood group.

Contacted by Lusa, the League of Portuguese Firefighters (LBP) confirmed the situation, admitting that the information on this computer attack should have followed individually for each of the elements registered in the GNIP.

António Nunes, president of LPB, explained that the application of GNBP, which has about 60,000 records, has no bank data.

In its alert to the regional commanders and officials of the autonomous regions of the Azores and Madeira, the ANEPC explains that, as a result of the breach of personal data, data subjects may be subject to ‘phishing’ (messages simulating legitimate communications to attract malicious clicks and links and attachments), ‘smishing’ (tempts of SMS or MMS fraud) or ‘vishing’ (frauds by telephone call).

They may also be the target of ‘quishing’ actions, a fraud scheme that uses malicious QR codes to redirect victims to fake websites.

The GNIP is the system of information and management of the registration of Portuguese firefighters, the command boards, active, reserve and honor.