A Cyberattack Shuts Ovar Council's Public Services Until Wednesday, and the Town Hall Suspends Administrative Deadlines

The Câmara Municipal de Ovar (Ovar municipal council), in the Aveiro district, says a cyberattack over the weekend has left its computer system inoperative. All municipal services will be closed to the public up to and including Wednesday, 21 October, the council told the Lusa news agency on Sunday, 18 October.

The council said the attack was detected "this weekend" and that it has reported the case to the police. It added that it is meeting "all legal responsibilities" that follow from the incident and that a technical team is working on containment, assessment and recovery "as quickly as possible, in coordination with the competent bodies". It did not name those bodies, and it has not said whether any personal data was accessed or taken.

What is closed until Wednesday

Because the system serving the council's main departments is down, the council listed these as closed to the public:

• the general front desk (Atendimento), the planning department (Urbanismo) and the veterinary service;
• the BUPi desk (Balcão Único do Prédio, the one-stop office for registering rural land boundaries);
• the Ecocentro recycling centre and the council's EcoLinha waste line;
• the Centro de Arte de Ovar, the Escola de Artes e Ofícios (arts and crafts school), the Museu Escolar Oliveira Lopes and the Casa-Museu Júlio Dinis;
• the council's online services.

What still works

The council expects the Espaço Cidadão (Citizen Spot, the counter for national services such as the Citizen Card), the municipal market, the swimming pool, the library, the Espaço Empreendedor (business support space) and the cemetery to open as normal, "as far as can be foreseen at this time". The SIGA online platform for school services and the dedicated planning telephone line also remain available. The notice did not mention water supply or bin collection.

Deadlines and data

Many of the closed services involve legal deadlines, for example in planning applications. The council says it "will suspend all deadlines in administrative procedures under way", so that no resident is penalised by the outage. It has not yet said how the new dates will be counted once services reopen.

If personal data turns out to have been affected, the General Data Protection Regulation sets out what the council must do. Under Article 33, a controller must notify the Comissão Nacional de Proteção de Dados (CNPD, the national data protection authority) within 72 hours of becoming aware of a breach, unless the breach is unlikely to put people at risk. Under Article 34, where the risk to people is high, it must also tell those affected directly and without undue delay. The CNPD receives these notifications through an online form.

The council has not warned of any fraud linked to the attack. With its systems down, though, any message this week that claims to come from Ovar council and asks for payment, passwords or bank details deserves extra caution. Posing as officials is a familiar tactic in Portugal: the GNR registered 193 scams by people posing as police or inspectors between January 2024 and May 2026.

The council says it will give updates through its official social media accounts. Its website, cm-ovar.pt, was not responding on Sunday evening.