The Department of Health in Northern Ireland (DoH) has temporarily suspended its online COVID-19 vaccination certificate service – COVIDCert – this week following a data breach. The Department said that some users of the “COVIDCert NI” had their data exposed to other users. Both the online service and the corresponding mobile app are currently inaccessible.
COVIDCert allows fully vaccinated people in Northern Ireland to obtain a digital certificate confirming their COVID-19 vaccination status. This is a separate system from the NHS COVID Pass used in England and Wales, and a similar “vaccination passport” used by Public Health Scotland.
The Northern Ireland service is available via the website covidcertni.nidirect.gov.uk or the mobile app for Android and iOS users.
Those visiting the service are seeing the following error message: "Our services are currently unavailable. We are working to restore all services as soon as possible. Please try again soon."
Also read: COVID-19 is damaging our intelligence, a new study says
The Northern Ireland Department of Health immediately reported the issue to the UK Information Commissioner's Office (ICO)after discovering it.
The DoH, in a statement on July 27 , said: “The Department of Health takes the privacy of citizens’ data very seriously and has contacted the Information Commissioner’s Office (ICO) as part of its due diligence in protecting citizens’ data. Immediate steps have also been taken to temporarily remove part of the service that manages identities.”
In addition, the Ministry published a list of those not affected by the security incident in question:
- Applicants (those applying between now and 31/07) who already have their certificate will not be affected – their applications or forms will still work.
- Candidates (until 31/07) who have applied via the online portal for a PDF download but have not yet received it will not be affected – the PDF will be delivered.
- Applicants (by 31/07) who have applied using the “COVIDCert NI” app for a digital certificate who have not yet received it will not be affected – they will be sent a PDF as an interim step.
In addition, the Ministry pointed out that some individuals who have already applied for a digital certificate or whose identity verification is pending will also not be affected.
See also: Johnson & Johnson COVID-19 vaccine: Risk of autoimmune disorder
The following can continue to use the services normally once they are restored:
- Candidates (until 31/07) who have applied for a digital certificate and received a PDF copy will be able to log in and download a digital version, after the issue has been resolved.
- Candidates currently undergoing identity validation in the NIDirect workflow can continue. Once their identity is successfully validated, they should pause while we fix the above issue.
Suggestion: SolarWinds hackers: Use iOS zero-day bug to compromise updated iPhones
Some users may find that they are unable to log in to their NIDirect account as they have been locked out due to the technical issue.
This data incident, while seemingly minor, comes at a time of heightened scrutiny and concern over COVID-19 vaccination passports. Hackers are targeting, often successfully, critical healthcare systems, then demanding huge ransoms.
Information source: bleepingcomputer.com
