Hackers who recently disabled EPS's online system and then demanded a sort of "ransom" for the return of the stolen data have released more than 34 gigabytes of that user data online.
Also, they made it available for download via the Qilin blog, on the Onion network.
At the same time, it was announced that the second part of the EPS database will be published on Monday, January 22. The link that leads to the possibility to download the data published so far can be found on social networks.
EPS has not been advertised for now.
Data not protected
Information security expert Ivan Marković tells "Vreme" that malicious hackers generally initially gain access to data by compromising user email accounts and workstations, all through targeted "phishing" attacks.
"Next, by penetrating the system, malicious groups analyze the compromised environment and collect vital business data, databases with personal data, sensitive technical details and the like. The group that compromised EPS practices double blackmail tactics, they lock the data and copy it to their servers," says Marković.
He adds that the country's critical systems are not adequately protected. As he says, it is necessary to do a complete audit, bring honorable people to responsible positions, and then apply technical and organizational measures according to industry recommendations.
Recovering from an attack
Let us remind you that on December 19, EPS issued a statement that it is recovering from an unprecedented hacker attack, of the crypto type, which did not in any way threaten the production or the supply of electricity, and all electricity trading activities continued without interruption in compliance with the obligations assumed.
"For security reasons, IT systems have been put out of action until ICT experts are absolutely sure that the virus has been eliminated." We appeal to the patience of users of the Insight into the account portal, because due to the security measures taken, the operation of the portal has been hampered," EPS announced at the time.
It was also stated that the competent state authorities were informed about the hacker attack "and are taking measures within their competence".
Who is responsible for citizens' data?
The Green-Left Front expresses concern and demands responsibility for the compromised personal data of Serbian citizens after the publication of data that is available to everyone on the Internet.
"Personal data was taken during a hacker attack on the system of Elektroprivreda Srbija, due to which a large number of citizens have late electricity bills.
After the daily abuse of the system with the personal data of political opponents and citizens unfit for government, the party's employment of incompetent personnel has today made it possible to freely manipulate the personal data of our citizens on a global level", according to the statement of the Green-Left Front/ We do not drown Belgrade.
They call upon the Acting General Director of EPS, Dušan Živković, as well as other officials to finally address the public, tell the truth and answer the following questions:
Did EPS pay the hackers the requested amount to return the compromised data?; What data of Serbian citizens is at risk?; Who will bear the responsibility for such an omission and in what way?; What is the plan to prevent something like this from happening again and how will the data of the citizens of our country be stored?; Did the prosecutor's office, the BIA and the MUP launch an investigation into all these matters?
The Green-Left Front demands an urgent investigation and accountability of all those who have led to this extremely worrying situation.