In December, Commissioner for Personal Data Protection Irene Loizidou Nikolaidou issued a decision regarding cyber-attacks on the network of the Land Registry and Mapping Department.
The decision includes recommendations and requests for updates on previous recommendations within two months.
In her announcement, Commissioner Nikolaidou recalls that on March 13, 2023, a Data Breach Notification was submitted to her office by the Land Registry and Mapping Department.
The notification stated that on March 8, 2023, the department experienced a cyber attack affecting its Digital Land Services (DLS) Portal.
A thorough investigation revealed that although the attacker did not gain access to personal data, the attack did impact data availability.
The systems were temporarily disabled for investigation, causing a disruption.
Commissioner Nikolaidou emphasizes the responsibility of data controllers to ensure continuous availability and reliability of processing systems and services.
The temporary unavailability of data could have affected data subjects due to the inability to serve them, even if temporarily.
The Commissioner notes that since the attacker had gained access to the department’s servers, there was a possibility of accessing other systems/subnetworks containing personal data.
According to Nikolaidou, after examining the technical and organizational measures taken before the incident, the investigation results, actions taken after the incident, and planned actions for further system reinforcement, a violation of the Regulation was identified due to the non-implementation of adequate security measures.
On December 21, 2023, the Commissioner issued a decision reprimanding and instructing the Department to provide updates within two months on the progress of implementing additional measures, obtaining additional equipment, the results of the new penetration testing, the stage of resolving findings, and the timelines for implementing actions to enhance system security.
It is clarified that the decision took into account all incidents related to the case, emphasizing that no access to personal data by the intruder was detected.
Additionally, the timeframe during which data availability was affected was limited, with a full system restoration occurring after a month, and several services being provided to citizens with physical presence after about a week. The decision also considers the absence of substantial damage to data subjects.
