AZOP Launches Investigation into HZMO over Possible Cyberattack
The Croatian Personal Data Protection Agency (AZOP) has launched an ex officio investigation into the Croatian Pension Insurance Institute (HZMO) following reports of a possible cyberattack and the public disclosure of Croatian citizens’ personal data, according to ICTbusiness. The investigation was initiated after a group calling itself INF Group claimed to have obtained a database containing 105,000 records allegedly originating from HZMO systems. According to the attackers’ claims, the exposed information includes names, personal identification numbers (OIBs), phone numbers and email addresses.
However, the authenticity of the published database and its connection to HZMO’s information systems have not yet been officially confirmed, and the origin of the data can only be established through technical and forensic analysis. Following the initial reports, HZMO stated that it had no information confirming a security breach, while AZOP has so far not received a personal data breach notification from the Institute or any other authority. The investigation will seek to determine whether unauthorized access actually occurred, when HZMO may have become aware of the incident and whether its reporting obligations under the General Data Protection Regulation (GDPR) were triggered.
Under Article 33 of the GDPR, a data controller must notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to individuals’ rights and freedoms.
If the reported data compromise is confirmed, the combination of exposed information could increase the risk of targeted phishing, vishing, identity theft and other forms of social engineering. If the breach is assessed as posing a high risk to affected individuals, the GDPR also requires them to be informed directly, subject to certain exceptions. Final conclusions regarding the potential data breach and any possible responsibility of HZMO will only be possible once the investigation and analysis of the collected information have been completed.
