The key facts
- More than 15,000 user accounts of Slovenia's government administration system were affected, with hashed passwords in 7,216 of them
- URSIV demanded an urgent password reset and recommended enabling multi-factor authentication
- The SIGOV-CERT center is investigating; information on new measures will be published
Breach via a compromised government server
Slovenia's government Information Security Administration (URSIV) reported that a hacker gained access to data from more than 15,000 user accounts of the republic's government administration system. To break in, the attacker used a compromised web server of one of the government agencies, through which it was possible to obtain user records of the Domino platform. In 7,216 of them, hashed password values were stored, which in some cases can be recovered. The agency published a notice on the government portal; details are reported by Life.ru.
What has been done and what has been recommended
After the attack was detected, the server was isolated from the network. URSIV demanded that administrators of government information systems urgently reset the passwords of all affected accounts. Users were also advised to change their passwords on other work and personal resources if the same or similar combinations were used there, and to enable multi-factor authentication to protect their accounts. The circumstances of the incident are being examined by the government administration computer incident response center SIGOV-CERT together with technical services; URSIV promised to publish information about new investigation findings and additional response measures.
A similar incident at a Berlin clinic
Separately, Life.ru recalls a recent attack on the server of one of Europe's largest university clinics — Berlin's Charité, where personal data of employees, students, and people who had contacted the medical facility was stolen. The attackers broke into the web server hosting the hospital's website; the leak affected the contact information of users of online forms, including those who had tried to book a doctor's appointment. The exact number of victims has not been disclosed. According to the outlet, a week before the incident, the clinic had temporarily taken its website offline due to a discovered vulnerability in PHP software.
