The perpetrator of a major hacking of the City of Helsinki's education division's database could have accessed the personal information of all compulsory school aged children in the capital, as well as their parents or guardians, the city has revealed in a press release.
City authorities announced last week that the data breach affected about 80,000 parents and guardians, but this figure is now estimated to be 150,000. The hacker also gained access to the information of around 38,000 City employees.
"The City of Helsinki stores information on persons of compulsory school age from Helsinki, and their parents, based on the City’s duty to monitor the achievement of compulsory education," the statement said, adding that the information was "stored on a City network drive" impacted by the breach.
The stolen data included the following information about children in Helsinki born between the years 2005–2018, as well as of their guardians:
- Personal IDs of the child and guardian.
- Addresses of the child and guardian (no phone numbers or email addresses). No addresses, phone numbers or email addresses of persons with a non-disclosure restriction were included.
- Native language of the child.
- Nationality of the child.
- Religious community of the child (evangelical Lutheran / orthodox / registered religious community / not part of a religious community).
The data may also include passport numbers of families with foreign backgrounds.
Matias Mesilä, a data security expert from Traficom's National Cyber Security Centre described the breach as "possibly the largest data breach affecting [Finland's] municipal sector".
The city's statement on Tuesday further noted that, in addition to its own schools and daycare centres, the region's private educational sector may also be affected by the data breach — including "private day-cares, contractual schools in Helsinki, private and state-run schools as well as private upper secondary schools and vocational schools".
The National Bureau of Investigation (NBI) and Helsinki police are currently investigating the case, with the City of Helsinki listed as the suspected victim of the crime. The City's statement noted that members of the public who believe they may be affected by the breach do not need to file police reports.