As a result of a security incident, a database which contained information on citizens who applied for circulation permits due to the mandatory social isolation caused by the emergency situation caused by CIVID-19, was exposed on the web. Circulation permits allow citizens to move freely despite the restrictions imposed by the isolation.The personal data affected by the incident were stored in a database belonging to the Health Ministry of the Province of San Juan.
Among the data exposed (115,000 records in total) were data such as full names, ID numbers, tax identification keys, as well as other data of the applicants of the permits to circulate. At least 33 thousand of the records include the telephone number of the data subjects. Also, the permits included information about the employer, the employer’s location, the employer’s telephone number, whether the permit holder is a medical professional or not, and the number of the procedure on the DNI (the “Personal Data”).
As reported by the comparitech.com website, the Personal Data was exposed for at least two weeks on the website without any protection or security. On July 12, 2020, the database was indexed by the BinaryEdge search engine, and was finally removed by the Health Ministry of San Juan on July 29, 2020.
By the time the incident was discovered, the database had already been infiltrated by a “meow bot”, an automated bot responsible for destroying hundreds of exposed databases in the last few weeks. In this case, fortunately the Personal Data was not affected by the bot.
Due to the nature of the Personal Data, the affected data subjects could be exposed to phishing campaigns, identity fraud and even fraudulent tax operations.
So far, the authorities of the Health Ministry of the province of San Juan have not issued any statement on this matter.
