Summary
- Portugal's ANEPC says the national firefighters' register was attacked and personal records may have been copied.
- The authority suspended the register and is working with national cyber and internal security bodies.
- Around 60,000 registry entries do not equate to 60,000 confirmed stolen records.
Portugal’s National Emergency and Civil Protection Authority has suspended the national register of firefighters following a cyberattack in which personal information may have been copied. The authority is working with the country’s cybersecurity and internal security bodies to investigate the incident and strengthen protection of the affected application.
The attack concerns the Recenseamento Nacional dos Bombeiros Portugueses, or RNBP, a registry used to administer information about firefighters and their operational status. In a statement circulated on 24 October, ANEPC said an attacker may have obtained copies of personal data stored in the application. It suspended access after detecting the incident, in coordination with the National Cybersecurity Centre and the national internal security network operated under the interior ministry.
The authority also sent an internal communication to organisations responsible for fire brigades and to the brigades themselves. Its warning addressed possible fraud using exposed information. The attack’s method, the attacker responsible and the precise volume of records obtained have not been established in the public statement.
Portuguese reporting citing the Lusa news agency describes personal information held in the registry that can include identity and contact details, official identification numbers, photographs and information used for administrative purposes. Those reports describe the categories potentially reachable in the system, rather than providing a verified accounting of every field copied by the intruder.
The firefighters’ representative body has said the registry contains approximately 60,000 entries and does not hold bank details. That figure is a measure of the system’s population, not a confirmed count of people whose data was exfiltrated. A forensic investigation must distinguish whether an intruder viewed, exported or altered particular datasets and whether the same records were held across multiple components.
Unlike a customer database at a commercial website, the RNBP serves an operational public service. It records information needed to maintain administrative visibility over active personnel and other firefighter categories. A deliberate suspension can restrict direct access to the application while investigators assess whether the system can be trusted, even though it does not establish that emergency response capability itself has been disrupted.
ANEPC has not reported a suspension of firefighting operations. The public evidence supports a narrower description: an administrative application has been taken offline as a containment and protection measure. The registry suspension is not evidence of dispatch failures, delayed emergency responses or compromise of command systems. The authority has not reported those operational consequences.
The categories of information potentially present create a different exposure from a simple email-address breach. Official identification details and service-related information can support convincing impersonation, especially when combined with contact information. The authority’s communication warns that fraudulent contact could follow the incident; it has not said that secondary fraud has already been observed.
There is also an accountability issue over notifications. Internal communication through brigade management may distribute instructions rapidly, but it is not necessarily equivalent to individually notifying every person whose data was involved. The timing and form of any further notification will depend on what the investigation establishes and the applicable Portuguese and European data protection requirements.
Public bodies managing workforce registries must balance containment with continuing administrative access. Isolating a system can protect records while also complicating routine updates, verification and audit trails. Restoring a compromised registry requires confidence not only in the infrastructure but in the integrity of the records themselves.
The public descriptions of the register include command, active, reserve and honorary categories. That range makes accurate scoping important because individual records may not reflect current operational assignments. A list containing historical or administrative entries has different downstream consequences from a verified roster of personnel currently deployed to emergencies. The authority has not publicly distinguished which categories were present in any copied material or whether dates and status changes could be reconstructed from the available logs.
ANEPC says work is under way to reinforce the application’s security. It has not published a timetable for reactivation or a final assessment of the records copied during the attack.
