PTAC Data Stolen Through Vulnerability in Public-Facing System
Summary
Attackers exploited a vulnerability in PTAC’s public-facing ASDIS system and stole contact data. PTAC shut down the system, notified affected people, and is assessing the incident and security risks.
Key points
- CERT.LV said the attacker accessed the system through a vulnerability in its public-facing component; no internal system access or internal user account was involved.
- The stolen information included contact details for 697 business representatives and 34 PTAC officials. Of the business representatives, 106 had data that was not meant to be publicly available.
- The affected data included names, email addresses, and telephone numbers. PTAC said the system did not store personal identification codes.
- CERT.LV detected the incident while monitoring publicly available information and notified PTAC on the evening of September 1.
- PTAC said it informed affected people, reported the incident to CERT.LV and the Data State Inspectorate, and shut the system down on the morning of September 2.
- PTAC said the system had known vulnerabilities and was considered outdated; it is assessing the incident and plans to engage ethical hackers to test system security before restoring it.
Article Details
- Victim Organization
- Patērētāju tiesību aizsardzības centrs (PTAC)
- Incident Type
- Data theft through exploitation of a vulnerability in the publicly accessible portion of PTAC's ASDIS system.
- Data Types Exposed
- Names
- Email addresses
- Telephone numbers
- Contact information
- Affected Records
- Contact information for representatives of 697 businesses and 34 PTAC officials was extracted. Of the 697 business representatives, 106 were people whose information was not required by law to be publicly accessible.
- Operational Impact
- ASDIS was closed on the morning of September 2 and was to remain unavailable until PTAC was confident it was secure. PTAC reported that it could not identify any losses at that time.
- Ransom Or Extortion
- No ransom was demanded.
- Claim Status
- confirmed