The Regional Transport Consortium (CRTM) of Madrid warned this February of a cyberattack that occurred in the early hours of November 22nd and compromised the data of travelers in possession of transport cards. According to data from the Community of Madrid, 57,299 crimes of this type were registered in the region between January and September 2023, 19% more than in the same period last year. At the time of publication of this article, neither this company nor the regional government's transport department had clarified the reason that led to the public announcement of the incident affecting the consortium being postponed for three months.
More information
“The databases containing information about public transport card holders have been compromised,” the company admits in a statement published on its website on February 14. “The person responsible for the processing of personal data communicates that this is a cybersecurity incident, thereby confirming a cyberattack of external origin, intentional and malicious, which has compromised the confidentiality of personal data,” it continues.
“The exact content of the possible extraction carried out as a result of the attack is not clear, although there is evidence of the extraction of information from databases of public transport card holders of the Community of Madrid with identifying data (first and last names), Address, email, telephone, city and province, zip code,…) and ticket sales,” he adds. Although the consortium assures that it is not aware of any problem due to the data leak, the risk is obvious: from receiving unsolicited communications to becoming a victim of a phishing or identity theft attempt using all the information collected in the attack.
The cyberattack on this company occurred just a month after the Telemadrid broadcast was interrupted for three hours due to a similar action. The incident also affected Onda Madrid, the regional public radio station. In the heat of these incidents, last December the government of Isabel Díaz Ayuso justified the need to create an autonomous cybersecurity agency in charge of setting up a Cybersecurity Incident Response Team (CSIRT) for the entire Madrid municipality.
These experts, the government said in a statement, “will be responsible for receiving, reviewing and reproducing all reports and activities related to events in the area and working with the attacked units to enable them to return to normality in the future.” prepared to avoid new incidents.” And he added: “This structure will also focus on strengthening the computer protection of the most important infrastructures, with particular attention to the health sector due to its importance.” Although the regional cybersecurity authority was approved by the regional assembly at the end of the year was approved, it is not yet fully utilized due to the absolute majority of the PP.
What influences the most is what happens next. To make sure you don't miss anything, subscribe.
Subscribe to
The reason? The government was forced to abandon the appointment of its chief executive when EL PAÍS announced that a retired Civil Guard general affected by the Zabalza case had been chosen for the position. This position remains vacant for the time being.
Subscribe to our daily newsletter about Madrid here.