Andorra coordinates international response to CASS cyberattack and warns of potential scams

The Andorran National Cybersecurity Agency (ANC-AD) has confirmed that it is maintaining ongoing coordination with national and international authorities following the security incident detected at the Andorran Social Security Fund (CASS), which originated from the theft of digital certificates belonging to several authorised filers.

The agency explained that it is working alongside CSIRT-AD, Andorra's computer security incident response team, and CASS itself to monitor developments, exchange threat intelligence and coordinate any necessary measures.

Authorities have also issued a warning about the risk of personal information obtained during the incident being used in future digital scams, particularly through fraudulent emails, text messages and telephone calls.

What is Andorra doing following the CASS cyberattack?

The National Cybersecurity Agency has confirmed that it was informed of the security incident involving stolen digital certificates used by authorised CASS filers.

Following this notification, ANC-AD and CSIRT-AD have maintained contact with the relevant authorities, both domestically and internationally, to coordinate their response.

According to the agency, this cooperation aims to share information about potential cyber threats, provide technical intelligence to CASS and coordinate any necessary measures within each organisation's responsibilities.

The exchange of cybersecurity intelligence is intended to help identify suspicious activity and support a coordinated response to any further developments.

The agency's statement does not specify how many individuals may have been affected or the full extent of the compromised information.

Cybersecurity authorities warn of potential scams using stolen information

One of the main concerns raised by the authorities is the potential misuse of information obtained during the incident.

ANC-AD has warned that the data could be used to develop phishing, smishing and vishing campaigns, three types of digital fraud designed to obtain confidential information through different communication channels.

Cybercriminals could send fraudulent emails, SMS messages or make telephone calls while impersonating government agencies, financial institutions or other trusted organisations.

These communications may appear legitimate and could use personal information to persuade recipients to disclose passwords, login credentials, banking details or other sensitive information.

The agency stressed the importance of remaining vigilant, although it has not confirmed any new fraudulent campaigns directly linked to the CASS incident.

Citizens urged to be cautious about suspicious emails and calls

In response to the situation, the National Cybersecurity Agency is urging citizens to exercise particular caution when receiving unexpected communications requesting personal or confidential information.

The agency strongly advises against opening suspicious links or downloading documents from unknown sources, as these could redirect users to fraudulent websites or expose their devices to additional cybersecurity threats.

It also recommends verifying the sender's identity through official channels, especially when a purported government agency or financial institution requests passwords, account details or personal documents.

These recommendations reinforce the warning already issued by CASS to its members, encouraging them to remain alert to potentially suspicious communications.

The aim is to prevent an initial security incident involving digital certificates from leading to further identity theft attempts or financial fraud targeting citizens.

Protecting digital certificates remains a priority

ANC-AD has also emphasised that protecting information systems and digital credentials is a shared responsibility among public institutions, businesses and individuals.

The agency stressed the importance of securely storing digital certificates and access credentials to prevent unauthorised third parties from using them.

It also highlighted the need for monitoring systems capable of detecting and containing suspicious activity before it leads to further security incidents.

Coordination between ANC-AD, CSIRT-AD, CASS and the relevant authorities will remain focused on monitoring the incident and exchanging information to support appropriate measures.

Meanwhile, cybersecurity officials continue to stress that remaining vigilant about fraudulent requests for personal information is one of the most important ways citizens can protect themselves.