theAndorran Data Protection Agency (APDA) considers that l‘improper access to affiliate information of the CASS constitutes a breach of personal data security. The regulation obliges to notify the incidents that pose a high risk to the rights and freedoms of those affected and, consequently, from the organization there was a clamor to adapt the defense systems to the resources used by cybercriminals, which are increasingly sophisticated.
The incidencereported Thursday by the parapublicwas produced through the portal of declarants, after the attackers used digital certificates stolen from various companies. With these accesses they were able to carry out automated queries that returned data such as the name, surname, sex, date and place of birth of the affiliates. According to the CASSthere was no direct access to databases or health, economic or benefits information. Belina Babiinspector of theAPDApointed out that administrations must adapt defenses to attackers who have more resources. “The security measures we put in place as organizations must be stronger every time“, he noted. Babi admitted that keeping pace with new techniques “it’s not easy” and asked that the CASS analyze “what happened, how did it happen” and adopt the necessary measures to avoid a similar situation.
“The danger is not what they have stolen, but the messages we will receive in a few months”
Sebastian Gonzalezdirector of Dcode Consultantsinterprets that the attack did not require directly breaching the system, but rather leveraging stolen credentials. “They didn’t force a door – they used a stolen key“, he summarized. In his opinion, the priority is to limit the volume of queries that can be made, reduce the data visible in each search and add a second authentication factor to digital certificates. The expert also warned of the risk of future scams with personal information that cannot be modified, such as the date of birth or the NIA. “The danger is not what they have stolen, but the messages we will receive in a few months”, he warned, recommending to distrust communications that appear to come from the CASS and avoid accessing through links received by message.
THE FALL OF MICROSOFT TOUCHES COMPANIES IN THE COUNTRY
thecomputer outage started on thursday and continued to cause problems during the day yesterday in services such as Outlook, Teams, Microsoft 365 i co-pilot. Microsoft confirmed connectivity difficulties in several regions following a high load on part of its infrastructure. The first problems were detected in accessing the mail ofExchange Online in the American continent, but then they spread to other areas. The multinational recognized that the measures applied to resolve the incident have had a “limited success” and that it is studying other alternatives, without setting a date for full recovery.
