Portuguese intelligence agencies suffer unclassified data breach

A cyberattack targeting a development server of an IT service provider has exposed unclassified data related to Portuguese intelligence agencies. The Sistema de Informações da República Portuguesa (SIRP) confirmed that the breach occurred via a testing server used by a contractor hired in 2025 to design public websites for the SIRP, the Serviço de Informações de Segurança (SIS), and the Serviço de Informações Estratégicas de Defesa (SIED).

While the intelligence services emphasized that their official portals do not contain classified information, the breach involves approximately 120 gigabytes of data being offered for sale on a cybercrime forum. The leaked dataset reportedly includes over 312,000 files.

In addition to intelligence-related data, the breach may impact dozens of other public and private entities that utilized the same service provider for website construction. Preliminary analysis of the leaked data suggests it contains personal information such as names, civil identification numbers, tax IDs, phone numbers, dates of birth, email addresses, and nationalities, specifically linked to professional applications.