Thousands of drivers were exposed to a data breach by hackers, according to an investigation by the Irish Independent. The driver data belonged to people whose vehicles had been towed by police.
See also: Iranian OilRig hackers stayed in a Middle Eastern government network for 8 months
More than half a million documents have been exposed, including insurance details, vehicle registration certificates, car impound notices and credit card details.
The breach was caused by a bug at a Limerick-based IT services company, which works with towing companies working for An Garda Síochána.
Police authorities claim they are not responsible for the leak, and the Data Protection Commissioner (DPC) is currently trying to determine who is ultimately responsible.
It is unclear how long the security vulnerability has existed or how many people may have gained access to the driver data, which consists of 512,000 documents dating back to 2017.
Police were tipped off about the breach in August by international cybersecurity researcher Jeremiah Fowler. Mr Fowler said he had discovered an unprotected online database of work sheets, vehicle registration information, driving licences and other sensitive data. The online database was part of a storage system for 11 towing companies, which store records of towed cars for An Garda Síochána and other agencies.
Following the alert, the Police Service of Ireland (An Garda Síochána) contacted the Limerick IT services company and carried out its own investigation, which concluded that the risk to the public was “limited.” However, Mr Fowler said he was able to access debit card details, as well as driving licences and incident summaries.
See also: Lazarus hackers target users with fake interviews via trojanized VNC apps
It said other compromised documents were revealed and had been marked as “confidential,” including incident reports containing names and details of drivers, witnesses and several police officers.
Many other reports included details such as fees, registration numbers and names of individuals. The exposed images were high resolution, and could be used for identity theft or fraud, including emails and texts.
A police spokesman said a data investigation was launched “immediately” after Mr Fowler was made aware of the matter. The spokesman said 11 towing companies, used by the Irish police and other government agencies, have contracts with the Limerick-based IT services company to store their data in the “cloud”.
When contacted, the owner of the IT services company said the problem occurred while implementing a new software version for the data service provided to the companies. Describing the issue as a “bug,” he said his company provided an external service for the towing companies and other companies involved and was not directly involved with the police. He also said that most of the leaked data was not related to the police.
It was reported that the company secured the database within 70 minutes of being notified of the vulnerability and then performed a remediation process.
See also: Lazarus and Andariel hackers exploit TeamCity bug for network breaches
Regarding the measures taken to address cyberattacks and prevent future breaches, it is clear that a series of actions have already been initiated. Organizational actions and technical measures are integrated into a specific corporate strategy.
First and foremost, businesses are reviewing their security policies, focusing on strengthening security standards and extensive user training. Regular security reviews are now necessary to address the ever-changing cyber threat landscape.
Experimental threat management bridges the gap between past territorial security and present cybersecurity.
After that, organizations deploy monitoring and alerting systems to determine real-time threats and push notifications. The ability to respond quickly and effectively to a security breach can significantly reduce the impact on the business
Source: IrishIndependent
