Hackers breached the City of Helsinki via a security flaw exploit

The City of Helsinki is currently investigating a data breach incident within its education division. The city government discovered this activity late last month, and it presently affects thousands of children, guardians, and professionals.

The reports regarding the attack leaked earlier this month, forcing city officials to give additional details during a press conference this week.

According to the information, the attack occurred after an unauthorised individual acquired access to one of the city’s network drives by exploiting an unpatched vulnerability in a remote access server.

The officials did not specify which remote access products the hackers targeted. However, they did mention that a security patch for the bug was available at the time of the attack but had not been installed by their admins.

 

The compromised drive from the City of Helsinki holds various types of information.

 

The threat actors who accessed the drive owned by the City of Helsinki stored millions of files. According to reports, most files contained no personally identifiable information (PII), but a rumour revealed that some files featured usernames, email addresses, and physical addresses.

In addition, the exposed drive also contained information on fees, early education and care, children’s status, welfare demands, medical certificates, and other susceptible data.

One of the city officials expressed their concern by saying that the incident was a severe data breach attack as it could inflict consequences that would impact their customers and personnel.

Still, the worst part of this activity is that it compromised the city’s services and thousands of students and guardians.

Due to the massive amount of data exposed, the government will need a substantial amount of time to identify the exact damage the incident inflicts on relevant individuals. The city has already contacted law enforcement agencies that could help them address the situation.

At this time, the city does not require persons affected by this malicious activity to call the police. Instead, the government asks them to report any suspicious messages to their official websites so they can quickly identify or track down any cybercriminal activity.

No ransomware gang has claimed credit for the attack. The government should remain alert, as these types of campaigns commonly result in ransomware operations.