Last night, Slovenia was gripped by a fresh panic. Hackers had broken into the state administration’s information system! Passwords had to be changed immediately! The media, naturally, seized on the story, and the headlines made it sound as though someone had just taken control of the entire country. All that was missing was an announcement telling citizens to stock up on food and water. I’m surprised they didn’t go that far.
- Slovenia needs its own ocisti.net to expose inciting trolls, following Serbia’s lead
- Fact check / check the story about the French left-wing activist before sharing it
- I don’t want to pay for this government / Janez has invented the subscription state
What actually happened? Through a compromised web server belonging to a government body, an attacker obtained more than 15,000 user records from the Domino system. Among them were 7,216 records containing hashed password values. Yes, you read that correctly. Domino. Lotus Domino, the one some of us remember from the days when we used modems to get online.
Let’s be clear. A break-in and the theft of user data are serious security incidents. Those affected need to change their passwords. But that doesn’t mean hackers have taken over the country or accessed data of vital importance. It does mean, however, that the state clearly has quite a few questions to answer.
The story of Lotus Domino version 8.5.x is particularly interesting. It dates from 2009. IBM ended regular support for it in 2018 and extended support in 2021. That very version is reportedly still listed in the catalogue of standard software on the government’s NIO portal, which was supposedly updated this August.
If that is true, then in 2026 government documents still list software from 2009 whose support ended five years ago. It has not yet been confirmed that the attacked server was actually running that version. But it would be interesting to know which version it was running.
There is also one more simple question. Was the system protected by multi-factor authentication? Did they use single sign-on? How were passwords protected? Who was checking security? And why are we only asking these questions after a breach?
But the most interesting part of the story lies elsewhere. Just over a week ago, Oštro revealed that representatives of the Israeli company Dream Security met Prime Minister Janez Janša in July. Niko Gamulin, acting director of the information security office, was also at the meeting. They discussed testing its Sphere solution in the SIGOV-CERT environment.
After the revelation, the office responded that it had merely been a presentation meeting, that the solution had not been tested and that there had been no decision to purchase it. Then, just a couple of days after that explanation, comes the announcement of a cyber attack on the state administration.
What a coincidence, isn’t it? Of course, there is no evidence that the two events are connected. Still less that anyone deliberately caused the incident. But the sequence of events is interesting enough for us to ask whether this very incident will become a convenient argument for buying a new, expensive cyber security system. An Israeli one. Because we have apparently been friends with them since Janez took power. And favours have to be returned.
First, you tell citizens how vulnerable the country is. Then the saviours arrive with a solution. By coincidence, the solution already has a name. Sphere.
Perhaps it would make more sense first to update the existing systems, put basic security measures in place, review access management and establish how the attacker got hold of user data in the first place. We probably do not need an Israeli company and a former Austrian chancellor for that.
Instead of creating the impression that someone hacked the entire country, it would be far more useful if those responsible told the public precisely what was compromised, how many systems were affected and how long any vulnerabilities had been present.
If Dream Security’s Sphere ultimately turns out to be the solution to all our problems, then that will be a story deserving far more attention than yesterday’s sensationalist headlines.