Personal data of Portuguese president, ministers and intelligence chiefs exposed online – Portugal Resident

Subscribe to Our Newsletter
The personal contact details of Portugal’s president António José Seguro, government ministers and senior intelligence and security officials can be obtained within seconds through commercial subscription platforms, prompting investigations by the country’s criminal police and domestic intelligence service.
Mobile telephone numbers, email addresses and home addresses belonging to prominent figures are among the information available online, according to an investigation by Expresso.

The newspaper says today that it has verified the authenticity of details relating to around a dozen people – including President António José Seguro, two ministers in Luís Montenegro’s government and Vítor Sereno, secretary-general of Portugal’s intelligence system, SIRP.
Contacts belonging to national police director Luís Carrilho, senior officials at the National Cybersecurity Centre (CNCS), bankers and directors of major companies have also reportedly been found.
One Supreme Court judge confirmed that a published mobile number remains hers, although she no longer lives at the address listed alongside it.
The apparent security failure was identified by Italian cybersecurity specialist Andrea Mavilla, who alerted Portuguese authorities and submitted a report to the Security Intelligence Service (SIS).

Mavilla demonstrated how commercial platforms compiling information from numerous sources can retrieve the personal details of senior state figures in a matter of seconds.
He warned that the greatest danger lies not in the disclosure of an isolated telephone number or email address, but in the ability to combine information from different platforms and assemble detailed profiles of individuals and institutions.
“The risk is not simply the presence of a telephone number or an email, but the possibility of linking all this information and mapping entire sectors of the state,” he said.
According to Mavilla, commercially available databases, tracking services and artificial intelligence tools can turn scattered information into extensive personal profiles. These could then be exploited for espionage, identity theft, social engineering, phishing and other cyberattacks.
The CNCS said there are no indications that known infrastructure has been compromised. It has acknowledged, however, that leaks have emerged from business-to-business data platforms – including Lusha, ZoomInfo, UpLead and Apollo.io – and that it has contacted SIRP and the Polícia Judiciária accordingly.
Mavilla previously uncovered similar cases in Italy and Germany. His findings in Italy led the country’s data protection authority to fine Lusha €2 million for unlawfully processing personal data, including information concerning senior state officials.
Another commercial contact-aggregation platform reportedly holds particularly sensitive information concerning Portuguese public bodies. Expresso has withheld its name, although, it says, the company has already been sanctioned abroad over the unlawful collection of professional contact details.
SIRP said the existence of such databases is not a surprise to SIS. An official source said the intelligence service had worked for several years to prevent and limit the online spread of large quantities of personal and professional information.
Such data is routinely used in spam and aggressive marketing campaigns, but can also provide the foundations for more sophisticated phishing attempts, impersonation, social engineering and computer intrusions.
The revelations come amid heightened concern over European cybersecurity following Russia’s full-scale invasion of Ukraine in 2022.
In March, SIS warned of cyberespionage operations targeting government officials, diplomats, military personnel and members of civil society. The campaigns used social engineering, phishing and identity impersonation through applications including WhatsApp and Signal.
Mavilla argues that the readily accessible information now identified provides precisely the raw material needed to make such approaches convincing — and potentially far more dangerous.
source material: Expresso

Journalist for the Portugal Resident.