[Resolved][Severity: Major][Intrusion]

AMED: unauthorized access to a maintenance terminal of its HR system may have leaked personal data of about 1,400 staff and former staff

A terminal used by a maintenance contractor was broken into, and names and addresses of staff, dispatched workers and former staff on it may have leaked.

Disclosed

2020-12-11

Organizations involved

Leaked or at risk

1.4K

1,400

Downtime

Unknown

What happened

2020-12-10
The maintenance contractor reported that its terminal had been logged in to without permission during work, revealing the possible leak. [1] [3]
2020-12-11
The agency announced it. It cut the link between the terminals and the HR system's operating server, stopped the system, reported to the ministries and consulted the Metropolitan Police. [1]

Impact

The data that may have leaked is personal data of about 1,400 staff, dispatched workers and former staff stored on the terminal, including names, addresses, birth dates and affiliations. No research and development information was on it. No access to the operating server or staff terminals and no secondary harm was confirmed. [1] [3]

The agency's press office said it could not give the date and time of the access for security reasons. [3]