The Portuguese Armed Forces General Staff (EMGFA) suffered a cyberattack that allegedly allowed the theft of classified NATO documents, which are now being sold on the dark web.
The EMGFA is the government agency responsible for the control, planning and operations of the Portuguese Armed Forces.
See also: Bumblebee malware adds post-exploitation tool for stealth infections
The agency realized they had been cyber-attacked after hackers posted samples of the stolen material on the dark web, offering to sell the files to interested individuals.
American government intelligence agents noticed the sale of stolen documents and alerted the US in Lisbon, which in turn alerted the Portuguese government to the data breach.
Immediately, a team of experts from the National Security Office (GNS) and Portugal's national cybersecurity center was sent to EMGFA to carry out a full audit of the corps' entire network .
The story came to light by local news organization Diario de Noticias, which claims to have confirmed the validity of the information through anonymous sources close to the ongoing investigations.
These sources told the news agency that the leaked NATO documents are of "great seriousness," so their dissemination could cause a crisis with the country's credibility in the military alliance.
See also: CISA to services: Fix Chrome and D-Link flaws
The computers used by EMGFA are air-gapped, but the exfiltration used standard non-secure lines. Therefore, the first conclusion of the investigation is that the highest military body violated its operational security rules at some point.
To date, no official statement has been issued by the Portuguese state on the matter, but pressure for information from the political opposition is increasing following the revelations.
Many members of parliament expressed surprise today at the news of classified military documents being sold online – the country's intelligence agencies failed to detect such a critical breach.
See also: Iranian hackers encrypt Windows systems via BitLocker
Therefore, they asked the chairman of the parliamentary defense committee, Marcos Perestrello, to intervene so that hearings on the incident can be scheduled as soon as possible.
Information source: bleepingcomputer.com
