Austria wary of cyber attacks after personal data of foreign residents leaked online

A massive breach of IT security in the immigration and citizenship services of local authorities in the state of Carinthia has put all states on high alert.

Austria wary of cyber attacks after personal data of foreign residents leaked online
Austria is investigating a claim that spyware targeted law firms and banks (Photo by freestocks on Unsplash)

For more than two weeks, authorities in Austria have been trying to deal with a massive security breach of government systems in the state of Carinthia.

The primary victims seem to be foreigners, as the data leaked from departments that deal with immigration and citizenship issues.

A relatively simple phishing attack, when a hacker creates a fake email or webpage to give the appearance of official communication and asks the victim to click on a link, was how the IT systems in the state were first breached.

The malware entered the system, encrypted data, and now the responsible group, known as Black Cat, has been demanding a ransom to give access to precious information back to authorities.

READ ALSO: Stephansdom: Vienna woken up after hacker sets church bells to ring at 2am

Additionally, several consecutive attacks have blocked services and taken official websites off the air – though most of these have been restored.

The main issue now is that the hackers threaten Austrian authorities by leaking data from thousands of residents online. Some private information has already been revealed.

What kind of data do they have?

It has been difficult to ascertain how widespread the attack is, as the local government hasn’t been fully transparent. At first, they denied an attack, then they said the data breach concerned “only” public servants.

However, media reports have shown that entire files had actually been published online, including ID cards, passports, and corona test results from residents in Carinthia, a state in the south of Austria home to more than 560,000 people.

The groups that seem to be most affected are some 80,000 foreigners who have been granted a residence permit in the state since 1999, spokesperson of the state Gerd Kurath told a press conference.

“Data was read, but whether it was also stolen is still unclear”, he said.

READ ALSO: Six official websites to know if you’re planning to work in Austria

The hacker group also gained access to event management services, possibly retrieving data, including contact details and payment information from over 4,000 people and companies.

Finally, they also have government correspondence, including from the office of the governor Peter Kaiser (SPÖ).

What will they do with the information?

Ransomware works much like a hostage situation, except instead of people, criminals hold information. The group has blocked access to the information and is demanding $ 5 million as a ransom payment, which the government says they won’t pay.

They threaten to leak the data if the payment is not made. Still, it is unclear how much of the blocked information they can retrieve from government sites and leak.

If they do sell or publish data, people could have their identities stolen. The government says that if citizens become victims of identity theft, they will be informed about it.

What can I do now?

The state of Carinthia has set up an information hotline available every day from 8 am to 12:30 pm. People can call the line at 050 536 53003. However, no personal information, such as whether or not your own data has leaked, will be given at this moment.

At the moment, there is not much else people can do, data protection specialist Thomas Lohninger told Der Standard.

READ ALSO: Austria’s Foreign Ministry hit by ‘serious cyber attack’

Austria is not well prepared in terms of IT security, he says. The country needs to invest more in preventing attacks, according to the specialist. “This includes a secure architecture and training employees”.

Most cyberattacks, including this one, start with human error – clicking on a wrong link – and proper training is essential to prevent them.

Private citizens should also refrain from sharing personal information online as much as possible – of course, that is impossible when sharing information with public authorities.

“It does not help that there is no risk of a penalty for the loss of personal data for the public sector”, Lohninger adds.

Member comments

Log in here to leave a comment.
Become a Member to leave a comment.


EXPLAINED: What to do if you experience online abuse in Austria

Following the suicide of an Austrian doctor who received threats from Covid-19 anti-vaccination activists, the government has now launched a new campaign to help victims of online abuse.

EXPLAINED: What to do if you experience online abuse in Austria

The Austrian medical community was left in shock in July when Lisa-Maria Kellermayr, a local doctor in Seewalchen am Attersee in Upper Austria, took her own life following months of online abuse.

Kellermayr, 36, had been targeted by anti-vaccination activists and Covid-19 conspiracy theorists for her out-spoken support of vaccines, and the abuse even included death threats. 

Her death prompted candlelight vigils and demonstrations in Vienna and the tragic story was picked up by news outlets around the world.

READ MORE: How Austria’s attempt to make vaccines mandatory changed the country

This led to calls for tighter laws against online bullying and the ability for perpetrators to be prosecuted in other EU countries – particularly as at least two of the people who are believed to have targeted Kellermayr are based in Germany, according to the Guardian.

The Austrian People’s Party (ÖVP) has even called for the creation of a special public prosecutor’s office to deal with “hate-on-the-net”, but this has been rejected by prosecutors and other political parties, as reported by ORF.

Instead, the Federal Justice Department has launched a new information campaign, website and hotline to help people dealing with online abuse.

FOR MEMBERS: What happens if you get arrested in Austria?

What is in the new campaign?

Austria’s Justice Minister Alma Zadic (Greens) said they have launched the campaign to raise awareness about the issue and to inform victims about the support available.

Zadic said: “It is important to me that those affected know that they are not alone in this situation and that the judiciary supports them with free psychological and legal process support.”

“You don’t have to cope alone with the extraordinary burdens that criminal proceedings can entail, for example through confrontation with the perpetrators.”

READ ALSO: Austria in shock over doctor’s suicide following anti-vax abuse

Part of the support package is the new website Hilfe bei Gewalt (Help with Violence), which details how to access help from the authorities, as well as secure free legal advice and representation from a lawyer.

The website states the service is for victims of bullying and/or hate online, defamation, stalking, terrorism, incitement, sexual violence and robbery.

The service is designed to be anonymous with options to contact the Justice Department by phone or via a chat box. The website also lists contact details for regional support services in all provinces across Austria. 

The free (kostenlos) hotline for Hilfe bei Gewalt is 0800 112 112.

Useful links

Hilfe bei Gewalt

Austrian Federal Justice Department