In the video at the top of this page, our security correspondent walks through what is known about the breach that has shaken the internal security service of a neighboring country, and explains why officials on both sides of the border are worried about what comes next.
The service confirmed on Monday that it had suffered what it called a serious intrusion into its systems. It did not say what was taken. But an internal review, a 34-page document seen by News., shows that the attackers spent about eleven weeks inside a personnel database holding records on roughly 14,000 current and former employees.
According to the review, the exposed files include names, home addresses, phone numbers and emergency contacts. For several hundred staff members, they also contain internal assignment codes that could reveal which unit an officer works for, including teams that operate under cover.
How the intruders got in
The review traces the breach to a remote-maintenance account belonging to an outside contractor that serviced the agency’s payroll software. The account was protected by a password alone, without a second login step, and connected through an older network gateway that had been scheduled for replacement more than a year ago.
Comments 4
Eleven weeks undetected is the part that should worry every agency still running contractor logins without MFA.
Do we know if officers working under cover were among the exposed files, or only headquarters staff?
The review was leaked to the press before families were briefed. That sequencing feels like another failure.
Remote-maintenance accounts with a password alone should have been retired years ago. This was preventable.