In brief

• Slovenia's information security office reported an attack that exposed more than 15,000 user records from the state administration Domino system.
• Of the stolen records, 7,216 contain hashed passwords, and officials urge immediate password resets.
• Russian outlets classed as propaganda media report additional details, such as a server disconnection and a PHP threat warning, that Slovenian media do not confirm.

What was taken

The Slovenian government's information security office, URSIV, announced the incident on Sunday evening, 1 November (Kibernetski vdor v državno upravo: Napadalec pridobil več kot 15.000 uporabniških zapisov – portal24.si). It said an attacker had obtained more than 15,000 user records from the Domino system used in state administration (Kibernetski vdor v sistem državne uprave: napadalec pridobil več kot 15.000 uporabniških zapisov, nujna menjava gesel – lokalec.si) (В Словении хакер получил более 15 тыс. пользовательских записей из госсистемы - Рамблер/новости – rambler.ru). The intruder got in through a compromised web server belonging to one state body, which has not been named.

Hashed passwords

Of the stolen records, 7,216 contain hashed passwords (В Словении хакер похитил более 15 тысяч записей из государственной информационной системы – NV). URSIV said that in some cases the original password can be recovered from such a hash.

What account holders should do

URSIV has told system administrators to reset passwords for all affected accounts immediately (Po vdoru v strežnik državnega organa poziv k menjavi gesel v državni upravi – rtvslo.si). It advises users who reused the same or similar passwords on other services to change them there as well and to enable multi-factor authentication where possible. Rambler, a Russian outlet that the source classification labels as propaganda media, reports that the compromised server was disconnected from the network. No Slovenian outlet cited in this report confirmed that detail.

Differences in the reports

mail.ru and news.ru, both Russian outlets labelled as propaganda media, describe the accounts as belonging to civil servants (В Словении хакер получил данные 15 тыс. учетных записей госслужащих – mail.ru) (Киберинцидент в Словении: взломаны данные 15 тысяч госслужащих – news.ru). Slovenian outlets describe them as user accounts in state administration generally and do not specify job type (Alarm v slovenski državni upravi: Napadalec vdrl v informacijski sistem – siol.net). Early reports put the number at about 15,000, while Slovenian outlets say more than 15,000.

Slovenian media have not confirmed this claim.