Czech Ministry of Justice leaks personal data via new register test

The Czech Ministry of Justice accidentally exposed sensitive personal data through a testing version of its new commercial register portal. The leak occurred during a pilot phase of a modernized system designed to provide information on legal entities, including company leadership and mandatory documents like financial statements.

Two specific technical errors were identified. The first allowed the retrieval of birth numbers and the AIFO code—a unique identifier used by the state—when searching for individuals associated with companies. While these numbers were not immediately visible on the webpage, they were included in the server's data responses. The second error allowed users to access non-public documents by simply altering numerical identifiers in the system.

Following reports from iRozhlas.cz, the Ministry disabled the testing version and initiated an investigation. Officials emphasized that the current, active commercial register remains unaffected and continues to function without restrictions. The data involved in the testing version includes information related to nearly two million unique individuals registered within various companies and organizations.