SICT denies damage to internal systems or violation of personal data by hacking

Just two days after the Secretariat of Infrastructure, Communications and Transportation suspended deadlines and terms for various procedures and licenses until December 31, 2022, due to a “cyber incident in computer equipment”, the agency denied that the malicious software had damaged its systems or violated citizen data.

“The Secretariat of Infrastructure, Communications and Transportation (SICT) reports that the malicious software did not damage the agency’s systems or the data of citizens were compromised,” the agency said in a statement.

On October 24, the SICT announced through its Twitter account that it had “activated the Homologated National Protocol for Cyber ​​Incident Management and Contingency Plan, in accordance with regulations, in order to contain possible vulnerabilities to information and data derived from illicit access to IT equipment of the SICT”.

The secretariat in charge of Jorge Arganis Diaz Leal warned that it took containment measures after learning about the problem in computer equipment, on October 24. One of the “preventive measures” that were taken to “contain the spread of malicious software” was to temporarily suspend the systems “so that their services would not be compromised, avoid serious violations and even possible theft of information”, assured the agency in the statement.

The SICT explained that it has the support of the National Digital Strategy Coordination in order to work on the diagnosis and restore access to the systems “gradually and safely.”

However, for Hiram Camarillo, a cybersecurity specialist at Seekurity, a recovery period of two months, such as the one proposed by the secretariat by suspending the deadlines and terms of some of its procedures until December 31, is too long. According to the specialist, if the SICT had backup of the affected information and specialized security providers, it could resume its operation in a period of between 15 days and a month.

Perhaps they may not have the operational capacity to carry out a recovery process in a month or less, as has happened with the Ministry of Economy or with Pemex,” Camarillo said in an interview.

To this is added that 10 chambers of the automotive and motor transport industry, together with the Confederation of Industrial Chambers (Concamin), assured in a statement that 110 computer equipment within the SICT had been hacked and asked to install a table of work in order to establish a work table with the secretariat, to provide solutions to the contingency caused by the cyber attack.

The hacking of the SICT occurred just a month after the extraction of 6 terabytes of information from the servers of the Ministry of National Defense (Sedena) by the Guacamaya group was revealed, and although the agency has not confirmed what type It was a cyberattack, in the words of Hiram Camarillo, it will suffice for data from the secretariat to be disseminated on the internet to confirm that it was an information hijacking, that is, ransomware.