D-Trust informs about access to the application portal, even in healthcare

After D-Trust, a provider relevant for secure identities among other things, reported an attack on its application portal for signature and seal cards last week, the subsidiary of Bundesdruckerei is now reporting on its latest findings. According to the report, data from an interface of the “portal.d-trust.net” portal was read out on January 13. The company does not provide any further details, such as the extent to which the data was accessed.

“Application data for electronic health professional cards (eHBA) and practice and institution ID cards (SMC-B)” were also affected. Doctors need these special ID cards to access the telematics infrastructure – which is intended for the exchange of data in the healthcare sector – and to sign documents. The company repeatedly emphasizes that the “function and security of the issued signature and seal cards as well as eHBA and SMC-B […] access data (login, password data) and payment information” were not impaired or affected.

After the incident became known, the North Rhine Medical Association, among others, issued a warning to be vigilant, particularly regarding phishing emails, as reported by the Ärzteblatt. The German Medical Association was also in contact with D-Trust about the incident. After the incident came to light, the Interessengemeinschaft Medizin called for the electronic patient file to be stopped.

No manipulation of the data

It is possible that “first and last name, email address, date of birth and, in some cases, address and ID data” were tapped. It is also stated that the data was merely read out and that no manipulation of the data took place. According to D-Trust, the company is “cooperating closely with the responsible supervisory authorities. The criminal investigation authorities are also involved as a result of the criminal complaint filed by D-Trust GmbH”, according to an updated statement.

(mack)