Brazil's Ministry of Health has suffered a second cyberattack in less than a week, which has compromised several internal systems, including the platform that maintains COVID-19 vaccination data.
See also: Cyberattack on Brazil's Ministry of Health – Covid-19 data disappeared
The news came after a first major ransomware attack three days earlier, from which the department was still recovering. Confirming the second attack on Monday (13) afternoon, Health Minister Marcelo Queiroga said the latest incident, which took place in the early hours of the same day, was smaller in scope than the first attack.
According to Queiroga, the department is working to recover the systems as soon as possible. However, he said the second attack means that ConecteSUS, the platform that issues COVID-19, will not be back online today, Monday, December 14, as originally planned.
Queiroga noted that the attack was unsuccessful and that no data was compromised, but this second attack “caused disruption” and “prevented” the systems from coming back online. The Minister did not provide an estimate for when the affected systems would be restored.
The ministerial confirmation of the second cyberattack was preceded by an announcement from the Ministry of Health, according to which Datasus, the department's IT function, carried out a preventive systems maintenance exercise on Monday, which means that the systems will be temporarily unavailable.
See also: SPAR supermarket: Hundreds of stores closed due to cyberattack
The second attack meant that civil servants had to be sent home on Monday, as key health ministry systems, such as platforms that generate reports on the COVID-19.
Also last night, the Brazilian government's Institutional Security Office (GSI) released a statement confirming that new attacks had been carried out on cloud- managed by government agencies. However, it did not specify which departments or services had been targeted. It added that teams are being instructed to preserve data and that best practices regarding incident management are being followed.
In the first cyberattack, which was announced on Friday (December 10), all the websites of the Ministry of Health were “brought down”. According to a message left by the Lapsus$ group, which claimed responsibility for the attack, about 50 TB worth of data was extracted from the Ministry of Health’s systems and then deleted. Queiroga later said that the department maintains a backup copy to access the stolen data.
See also: Energy company DMEA lost 25 years of data in cyberattack
The National Data Protection Authority is working on the case and has contacted the Institutional Security Office and the Federal Police to collaborate with the investigations. It has also informed the Ministry of Health to provide clarifications on the case, in accordance with Brazil's general data protection rules.
Information source: zdnet.com
