Lithuania’s Ministry of the Interior has reported a cyberattack on the EPEKIS information system, which is administered by the Information Technology and Communications Department (IRD). This was reported by LRT.
The EPEKIS system was used to provide public services related to issuing documents and advising Lithuanian citizens and foreigners. It has not been actively used since 2018 and now functions as an archive.
The system stores archived data on foreigners who submitted documents to obtain Lithuanian citizenship. A significant portion of the information contains first and last names without personal identification numbers.
According to the Lithuanian Interior Ministry, the unauthorised access to the system was promptly blocked. Certain datasets were compiled after the attack, but there is currently no evidence that the perpetrators downloaded them.
The ministry noted that recently introduced cybersecurity measures helped detect the attack and prevent it from spreading further.
The incident was reported to the Criminal Police Bureau, the State Data Protection Inspectorate and the National Cyber Security Centre.
Lithuania’s Interior Minister Martynas Katelinas instructed officials to review the security of all information systems and databases under the ministry’s remit. He also did not rule out that artificial intelligence technology may have been used during the attack.
The Lithuanian Interior Ministry recalled that, following a previous incident at the state-owned enterprise "Centre of Registers", two-factor authentication and additional monitoring measures were introduced.
- In May, Lithuania’s Prosecutor General’s Office reported an investigation into unauthorised access to more than 600,000 entries in the Real Estate Register, which included, among other things, personal identification numbers.
- According to law enforcement, access was gained using compromised accounts belonging to employees of the Migration Department.