A significant data breach targeting mobile device accounts handled by Finland's Government ICT Centre, known as Valtori, affected a number of the country's national security and law enforcement agencies, Yle has learned.
The breach took place in late January this year, and was reported by Valtori on 6 February.
That prompted the National Bureau of Investigation (NBI) to open an investigation into suspected espionage and an aggravated data breach.
The state's IT services outfit said that the breach affected around 50,000 users, but that it did not affect all agencies or devices in the system.
Valtori said the breach compromised the individuals' personal data, including their names, work email addresses and phone numbers. Additionally, technical information about the mobile devices was also compromised, as well as country-level location information.
Valtori has not yet publicly identified the agencies that were targeted.
Following a formal request for information, Yle has seen documents showing that the breach affected several national security-related authorities.
For example, the documents said that the breach affected 'more than 50' individuals at Finnish Customs. The estimate was based on a form template, where 'more than 50' was the largest option.
The documents showed that an estimated 16-30 individuals at the National Police Board were affected by the breach.
The reviewed documents showed that the breach also affected the Finnish President's office. Similar to the situation at Finnish Customs, the data breach affected 'more than 50' individuals at the president's office.
Valtori declined to comment about the content of the documents that Yle requested and examined.
However, its Deputy Director General, Hannu Naumanen, emphasised that no information in the centre's secure network had been accessed.
7 May, 3.39pm: The story earlier incorrectly said that the data breach had affected the Finnish Defence Forces. In fact, the FDF initially suspected, based on documents, that it had been the victim of a data breach, but later decided that it had not been affected.
8 May, 9.21am: Removed FDF reference from headline.
