The president of the Junta de Extremadura, María Guardiola, is among the people whose data have been compromised in the recent cyberattack against the Servicio Extremeño de Salud (SES).
After the analysis carried out, it has been established that the incident has affected 18,416 users of the public health system of Extremadura, which represents around 1 percent of the total. These people have been notified by SMS, CSOnline, email and/or postal letter.
The cyberattack was detected by the SES last October 5, upon the discovery of an improper access that affected the confidentiality of the information available through the Centro de Salud Online application.
At the very moment the incident was identified, the security protocols provided for were immediately activated, containment measures were put into effect, and a complaint was filed with the Policía Nacional.
"The investigation initiated as a result of the complaint filed by the SES has allowed the Policía Nacional to identify the impact on other public administrations and make progress in clarifying these attacks. For all these reasons, the arrest of the alleged responsible person has been carried out," the Junta said in a press release.
As the regional Executive highlights, the complaint by the SES has favored a "police operation of greater scope, which has revealed the scale of the activity carried out against various public bodies".
As a result of the inquiries carried out, and of the joint work with the Policía Nacional, it has been confirmed that, in the specific case of the attack on the SES, there was unauthorized access to clinical information of the affected users.
The study of the incident has likewise made it possible to specify the number of affected people, which amounts to 18,416 patients of the health service of Extremadura, around 1 percent of the total number of users.
The Junta says that the entry route used by the attacker has already been located and the necessary corrective measures have been applied to reinforce the protection of the system.
"Legitimate accesses to the service function normally and no unavailability of the care systems has occurred," the Junta said.
The cyberattack was brought to the attention of the Policía Nacional and notified to the Spanish Data Protection Agency (AEPD). In addition, the incident was registered in LUCIA, the cyberincident management and notification tool of the National Cryptologic Center (CCN-CERT), following the established protocols.
The SES has informed all the affected people of what happened by means of SMS, CSOnline, email and/or postal letter. Among the users who have received these notifications, as confidential information having been compromised by the cyberattack, is the president of the Junta, María Guardiola.
The autonomous administration insists that sensitive information should not be provided in the face of suspicious communications and advises always verifying their authenticity through official channels.
As a general security recommendation, the Junta asks that extreme caution be exercised in the face of possible calls, emails, SMS or other messages requesting passwords, verification codes or personal or health data, as well as avoiding clicking on links or opening files whose origin is not clearly identified.