Hacker intrusion into state administration, more than 15,000 records compromised

An attacker managed to access more than 15,000 state administration user records through a single compromised web server. The data obtained also included password information, which is why the competent institutions have initiated urgent security measures and ordered the reset of the passwords of the affected user accounts.

The Information Security Office of the Government of the Republic of Slovenia (URSIV) informed the public about the incident on November 1. According to the findings so far, the attacker accessed data from the Domino system, and among the more than 15,000 records obtained, 7,216 contained hashed password values.

This does not mean that the attacker has obtained the passwords in a directly readable form. Hashtag is a security procedure in which a password is converted into a different value using a mathematical function. However, such protection is not foolproof. Attackers can use appropriate methods, especially for weak or frequently used passwords, to try to determine their original content.

That is why URSIV is requesting an immediate reset of the passwords of all affected accounts. Users who have used the same or similar passwords for other work or private services are advised to change them there as well. An additional protective measure is multi-factor authentication, in which knowing the password alone is not sufficient to log in.

The affected server was isolated from the network after the intrusion was discovered. The investigation is being continued by the SIGOV-CERT response center in cooperation with the competent technical services.

It is currently unknown who is behind the attack, how long they had access to the system, and whether they have already misused the obtained data.

The incident also highlights the danger of password reuse. A breach in one information system can open the way to other services if users use the same login details for them.