Cyberattack on national firefighters' register exposes data of 60,000 personnel
ANEPC confirmed the cyber attack on the National Register of Firefighters and warned of phishing, smishing and vishing attempts targeted at operatives.
Civil Protection confirms unauthorised access to personal data of Portuguese firefighters
The National Authority for Emergency and Civil Protection (ANEPC) confirmed on Saturday a cyberattack on the National Register of Portuguese Firefighters (RNBP), which allowed access to personal data of approximately 60,000 personnel registered in the system. The application has since been suspended, with procedures underway to strengthen its security, according to CNN Portugal.
The cybercriminals accessed sensitive information from firefighters on file, including full name, citizen card number, tax identification, social security number and health service user number, driving licence, marital status, date of birth, contact details, address, photograph and blood type. António Nunes, president of the Portuguese Firefighters' League (LBP), clarified that the database contains no banking details.
Alert for digital fraud targeting operatives
In an internal communication sent to entities controlling firefighter bodies and to the firefighter bodies themselves, ANEPC urges operatives to maintain "heightened vigilance" in the face of calls, messages or "other unexpected communications" requesting access to links or web pages, disclosure of personal data or completion of forms.
The authority identifies four types of attack to which firefighters are now more exposed: phishing (messages simulating legitimate communications to induce clicks on malicious links or attachments), smishing (fraud attempts via SMS or MMS), vishing (fraud via telephone call) and quishing, a scheme using malicious QR codes to redirect victims to fake websites.
In case of doubt about the authenticity of any communication received, ANEPC recommends that firefighters confirm the matter with the command structure of their respective firefighter body, "through the usual channels".
Institutional communications as reference
ANEPC clarifies that communications directed at firefighters — namely for data updates or transmission of information — "always use institutional channels, through the command structure of their respective firefighter bodies". The authority adds that it will continue to carry out the necessary steps to strengthen the security of its systems and the protection of personal data.
The Portuguese Firefighters' League confirmed to Lusa news agency what occurred, acknowledging that information about the attack should have been sent individually to each of the personnel registered on the RNBP.
The RNBP is the information and management system for the register of Portuguese firefighters, encompassing command, active, reserve and honorary personnel.
Source: CNN Portugal