Attackers Copied the Personal Data of Portugal's Firefighters From Their National Register, and Civil Protection Warns of Phishing

A cyberattack on the Recenseamento Nacional dos Bombeiros Portugueses (RNBP, National Register of Portuguese Firefighters) allowed the attackers to copy personal data held on the country's firefighters, and the application has been suspended, the Autoridade Nacional de Emergência e Proteção Civil (ANEPC, National Emergency and Civil Protection Authority) confirmed on Saturday.

In an internal alert to its regional commands and to the officials responsible in the Azores and Madeira, seen by the news agency Lusa, ANEPC said the register's database "was the target of a cyberattack, and it was possible to make a copy of the personal data". According to Lusa's report, carried by Público, ANEPC, the Centro Nacional de Cibersegurança (CNCS, National Cybersecurity Centre) and the Rede Nacional de Segurança Interna (National Internal Security Network) suspended the application immediately, and additional security systems are being built.

What the register holds

The RNBP is the national system for registering firefighters in the command, active, reserve and honorary ranks. According to the alert, as reported by Lusa, the data accessed includes full names, citizen card numbers, tax, social security and health service numbers (including health subsystems), driving licences, marital status, dates of birth, contact details, home addresses, photographs and blood group.

António Nunes, president of the Liga dos Bombeiros Portugueses (Portuguese Firefighters' League), told Lusa the application holds about 60,000 records and no bank details. He said the information about the attack should have been sent individually to every person on the register, and that he did not yet know whether data had actually been taken.

The register was created by Decreto-Lei n.º 49/2008 (Decree-Law 49/2008), which makes the civil protection authority (ANEPC's predecessor, whose duties it now holds) responsible for the security of the data in it. The annex to that law lists what the database may hold: beyond the items above, it includes height, place of birth, nationality, the names of parents, spouse and children, passport and pilot or boat licence numbers, qualifications, courses, disciplinary records, and the firefighter's occupation and employer. Records are kept for as long as a firefighter belongs to a corps and for up to 10 years after leaving. ANEPC has not said which of these fields were copied beyond those listed in its alert.

What firefighters are advised to do

ANEPC warned that people whose data was taken may be targeted by phishing (emails imitating genuine messages to get people to click on malicious links or attachments), smishing (fraud by SMS), vishing (fraud by phone call) and quishing (malicious QR codes leading to fake sites). In a press note reported by Lusa, it asked firefighters to stay alert to unexpected calls, messages or other contacts asking them to open links, share personal data or fill in forms.

• If in doubt, check the message with the command of your own fire brigade, through the usual channels.
• ANEPC says its messages to firefighters, including requests to update data, always go through the brigade's command structure.

Under the EU General Data Protection Regulation, an organisation that suffers a breach must notify the Comissão Nacional de Proteção de Dados (CNPD, National Data Protection Commission) within 72 hours unless the breach is unlikely to put people at risk, and must also tell the people affected when the legal conditions are met, as the CNPD explains. Lusa's reports do not say whether the CNPD has been notified. Lusa said it had asked ANEPC and the CNCS about the measures being taken and had not received a reply.

The attack follows the incident that disrupted Ovar council's public services earlier this month.