Police cell phones: Possible data leakage in Mecklenburg-Western Pomerania

Following a cyber attack at the beginning of June, the police in Mecklenburg-Vorpommern are unable to use their service cell phones. Investigations into the attack are ongoing. The first results are now available. It is therefore possible that data was leaked during the attack.

As reported by NDR, investigators have discovered that there are ways to leak data and leave only a few traces behind while recreating various attack paths on a replicated server. A spokeswoman for the Ministry of the Interior in Schwerin explained that the management server does not store any data from investigation or personnel files, but rather cell phone numbers, device numbers and user names – i.e. the names of police officers.

Exfiltration of data

The burglars had collected this data in a large file, which they apparently tried to exfiltrate in small packages, the ministry spokeswoman explained. It is possible that the perpetrators used the route now found by the investigators to exfiltrate some of the data. However, it is unclear whether and to what extent data was leaked.

According to the report, the malicious actors abused two vulnerabilities in the mobile device management software for the cyber attack. The mobile device management software comes from a renowned manufacturer, which remains unnamed. The service cell phones, also known as mPol devices, are still unusable. Officers use them on patrol, for example, to query vehicle owners or check identity documents. According to NDR, the police in Mecklenburg-Vorpommern are now using old radio technology instead of smartphones. It is currently unclear when the mPol devices will be usable again.

At the end of June, it became known that the cyber intrusion into the administration server had more far-reaching consequences for the police cell phones in Mecklenburg-Vorpommern than initially assumed. It turned out that the service cell phones could no longer be used.

(dmk)