Swiss hooligan database accessible on the dark web – Fedpol did not delete old data

An extract from the Swiss hooligan information system Hoogan from 2015 has appeared on the dark web. The data of as many as 760 people was stolen from the federal police service (Fedpol) during a hacker attack on the IT service provider Xplain.

The data was found during investigations conducted after Watson published the ransomware attack on IT services provider Xplain in June.

According to a statement issued on Wednesday, Fedpol inquired on its own initiative because “numerous people’s data is compromised to the same extent and there are reliable facts.”

What hooligan data are we talking about?

Among the data stolen by the Play ransomware gang and later released on the dark web was an eight-year-old XML file containing excerpts from the Hoogan information system. These include people who have committed violent crimes at sporting events in Switzerland and abroad and against whom the responsible canton or Fedpol has imposed a measure.

The data breach affected 766 people listed in the Hoogan system in September 2015. Fedpol notes that the file does not contain any information about violations or measures imposed. XML is a common file format used to exchange data between computer systems.

According to its own statements, Fedpol has already started directly and in writing to inform those affected by the data theft and leaks, as announced on Wednesday. The Federal Office has placed a form on its website for people who want to ask whether they appear in Hoogan’s stolen extract.

Why is the old Hooligan file not deleted?

Fedpol is not providing any information on why the nearly decade-old file has never been deleted, inside-it.ch said.

Under what circumstances and under what conditions the file reached the private company Xplain, is clarified according to the current statement from Fedpol. In June, a report was already filed against unknown persons.

Fedpol states that the publication of the extract does not affect the current operational use of the Hoogan information system. Information systems of the Federal Office would run in a secure federal infrastructure. There the data is secured.

Here’s how the attack went:

The ransomware attack on the IT service provider Xplain was made public by watson on May 23. The hackers had previously exploited a vulnerability on the servers of the IT service provider Xplain and stole data from the federal administration there, among other things, before launching an encryption attack (ransomware).

Not receiving a ransom, the cybercriminals made data from Fedpol and the Federal Office of Customs and Border Protection (BASG) accessible on the dark web site of the ransomware gang Play in early July. They would later release all the stolen files, over 900 gigabytes (GB).

The Federal Council wants to coordinate the extensive investigations and clean-up work after the serious cyber attack with a crisis team called “Data Outflow”. Federal Councilor Karin Keller-Sutter said that it must be ensured that the data breach does not continue and that such a thing is no longer possible in the future.

Sources

fedpol.admin.ch: Hacker attack on the company Xplain: excerpt from the information system “HOOGAN” from 2015 published on the dark web – those affected will be informed

(dsc/sda)