Cyberattack on Andorra's Social Security Fund exposes personal data of a large number of members

The Caixa Andorrana de Seguretat Social (CASS), Andorra's Social Security Fund, has detected a cybersecurity incident that allowed unauthorized third parties to access the personal data of a large number of its members.

The institution confirmed that attackers managed to retrieve identifying information through its business portal after using digital certificates stolen from several registered employers and authorized representatives.

According to a statement released by the CASS on Thursday, November 12, the attackers exploited a feature of the system to obtain first names, surnames, gender, dates of birth and places of birth of individuals registered with Andorra's Social Security system.

The institution insists that no access to medical, financial or social benefit records has been detected, although it acknowledges that the exposed information could potentially be used for identity theft and other fraudulent activities.

Attackers tested multiple combinations of administrative identification numbers

The security incident occurred through the CASS business portal, a platform that allows employers and authorized representatives to carry out administrative procedures related to their employees.

According to the institution, the attackers gained access to the private accounts of several authorized users using previously stolen CASS digital certificates.

Once inside the platform, they exploited a feature that allows users to retrieve personal information associated with an Administrative Identification Number (NIA).

This tool is designed to help employers verify workers' identities when registering them with the Social Security system.

However, the attackers used the feature to test multiple combinations of six digits and one letter, eventually identifying a large number of valid NIA numbers.

Through this method, they were able to retrieve the personal information associated with those identifiers.

The CASS has not yet specified how many people were affected or how long the unauthorized access continued.

What personal information was exposed?

According to the information released by Andorra's Social Security Fund, the attackers were able to access the following identifying details:

• First names and surnames of registered members.

• Gender of the individuals identified.

• Date of birth.

• Place of birth.

• Administrative Identification Numbers (NIA) used to retrieve the information.

The CASS emphasizes that the incident did not involve direct access to its internal databases or the systems where members' records are stored.

Consequently, the institution maintains that medical information, financial data and social benefit records were not compromised.

Nevertheless, the exposure of identifying information could have consequences for affected individuals, particularly if these details are combined with personal information obtained from other sources.

CASS warns of potential identity theft and fraud

One of the main risks identified by the institution is that the exposed data could facilitate identity theft, fraudulent communications or unauthorized requests for personal information.

The CASS explains that the NIA is not an official identity document, but it is a permanent administrative identifier.

When combined with names, surnames and other identifying details, this information could potentially be used to bypass inadequate identity verification procedures.

The institution warns that criminals could attempt to impersonate affected individuals when contacting organizations or services that do not have sufficiently robust identity verification systems.

Despite these concerns, the CASS says it currently has no evidence that the exposed information has been used fraudulently.

Police and cybersecurity authorities investigate the incident

As soon as the unauthorized access was detected, the CASS activated its established cybersecurity response protocols.

The institution states that it has implemented technical and organizational measures to contain the incident and prevent similar unauthorized access in the future.

It has also notified the relevant authorities, including:

• Andorra Police.

• Andorran Data Protection Agency (APDA).

• Andorra's National Cybersecurity Agency.

The investigation remains ongoing to determine the full extent of the incident, the number of affected members and the circumstances surrounding the unauthorized access.

Meanwhile, the CASS says that its business portal is once again operating normally and that all regular services remain available.

What should CASS members do?

Given the possibility that exposed identifying information could be misused, the Social Security Fund is advising members to remain vigilant about suspicious phone calls, emails and text messages.

In particular, it recommends that individuals avoid sharing personal or confidential information with people or organizations whose identities cannot be verified.

Members should also be cautious about communications requesting additional personal details, even when the sender already knows information that may appear to come from an official administrative source.

Anyone who detects suspicious activity can contact the CASS through the following channels:

• Telephone: 870 870

• General support email: cau@cass.ad

• Data Protection Officer: dpd@cass.ad

Suspected identity theft or fraudulent activity can also be reported to Andorra Police.

The CASS maintains that no fraudulent use of the exposed information has been detected so far, but the investigation remains open as authorities work to establish the full extent of the incident and its potential consequences.