Suspected hacking into Foreign Service's remote access service

After unusual activity was noticed in the Foreign Service's remote access service, the initial investigation confirmed a suspected hacking incident. The Ministry for Foreign Affairs has blocked the use of the service and made a request for an investigation to the Finnish National Bureau of Investigation.

On Tuesday, the National Cyber Security Centre launched an investigation together with the Ministry for Foreign Affairs, the Prime Minister's Office and the service provider. There is reason to suspect unauthorised access to the system.

Vulnerabilities had previously been identified in the Foreign Service's remote access service. The Foreign Service has since introduced enhanced information security monitoring and launched a process to switch to a replacement service. The responsibility for providing the Foreign Service with a remote access service belongs to the Prime Minister's Office.

Remote access can be used to process data at most at the Restricted level, i.e. the lowest security classification level.

The investigation is under way. Based on the current findings, no conclusions can yet be drawn about the attacker. No unusual activity has been detected in the Foreign Ministry's other systems. The ministry has made a request for investigation to the National Bureau of Investigation and notified the Finnish Data Protection Ombudsman.

Blocking the remote access service will not affect the Foreign Ministry's ability to perform its tasks, but it will make working more difficult for those who do not yet have a replacement solution available. The Foreign Service has provided some of its staff with a different remote access service. Work is under way to make the service available to all employees.