3 ms·

Among the interesting speculations is how he got access to such data and which countries were affected. "The man had information on passport data, taxpayer num

Among the interesting speculations is how he got access to such data and which countries were affected. "The man had information on passport data, taxpayer numbers, birth certificates, driver’s licenses, and bank account data." I suppose this must imply that quite a few governmental services have been breached (or, alternatively, a single big one).

risyachka 4y ago
You'd be surprised how many websites (medical, financial etc) are leaking data. e.g. in many all you need is just to replace your profile id with (id+1) and get other user's data. Especially if website owner is located in non-EU or western countries there is basically zero responsibility for this, so no one even bothers to hire a dev that understands these basic security things. The cheaper the better. I've seen dozens of examples myself without even trying. Imagine what you can get if you spend more than 20 minutes on this.
- jruohonen 4y ago
  Sure. Throughout the world, especially hospitals and healthcare seem to be particularly bad at infosec. But regarding this case, I think something like passport data is (or should be) fairly well-protected, which prompts further questions about the hypothetical breaches. Of course, it could as well be an insider case or something similar. Another point is that Telegram was again involved.
  - expertentipp 4y ago
    > I think something like passport data is (or should be) fairly well-protected It's sufficient if you're an EU citizen emigrating or traveling to another EU country. They ask you right and left for a passport, passport scan, over email, hard photocopy. You think you're "privacy conscious" and refuse to provide one? Well you're not getting an apartment, thanks bye. Hell, many HOTELS (encountered at least in Spain, Croatia, Malta) make a SCAN OF PASSPORT. Now for leaking hundreds of passport scans all you need is one bored, ill-treated, poorly paid reception worker.
  - popcalc 4y ago
    >I think something like passport data is (or should be) fairly well-protected It's astonishing how many times I've had to send scans of my passports to formations agents and banks (non-US) as email attachments in recent years. I always had on my mind how much damage could be done with a simple MX record cache poisoning.
rep_lodsb 4y ago
"Art. 362 (Unauthorized actions with information that is processed in computers, automated systems, computer networks or stored on carriers of such information, committed by a person who has the right to access it)" If that is an accurate translation, seems like he worked for the government.

risyachka 4y ago

You'd be surprised how many websites (medical, financial etc) are leaking data. e.g. in many all you need is just to replace your profile id with (id+1) and get other user's data. Especially if website owner is located in non-EU or western countries there is basically zero responsibility for this, so no one even bothers to hire a dev that understands these basic security things. The cheaper the better. I've seen dozens of examples myself without even trying. Imagine what you can get if you spend more than 20 minutes on this.

jruohonen 4y ago
Sure. Throughout the world, especially hospitals and healthcare seem to be particularly bad at infosec. But regarding this case, I think something like passport data is (or should be) fairly well-protected, which prompts further questions about the hypothetical breaches. Of course, it could as well be an insider case or something similar. Another point is that Telegram was again involved.
- expertentipp 4y ago
  > I think something like passport data is (or should be) fairly well-protected It's sufficient if you're an EU citizen emigrating or traveling to another EU country. They ask you right and left for a passport, passport scan, over email, hard photocopy. You think you're "privacy conscious" and refuse to provide one? Well you're not getting an apartment, thanks bye. Hell, many HOTELS (encountered at least in Spain, Croatia, Malta) make a SCAN OF PASSPORT. Now for leaking hundreds of passport scans all you need is one bored, ill-treated, poorly paid reception worker.
- popcalc 4y ago
  >I think something like passport data is (or should be) fairly well-protected It's astonishing how many times I've had to send scans of my passports to formations agents and banks (non-US) as email attachments in recent years. I always had on my mind how much damage could be done with a simple MX record cache poisoning.

rep_lodsb 4y ago

"Art. 362 (Unauthorized actions with information that is processed in computers, automated systems, computer networks or stored on carriers of such information, committed by a person who has the right to access it)" If that is an accurate translation, seems like he worked for the government.