Vehicle owner data theft now automated in Ticino

The Canton of Ticino is also among the regions affected by the cyber operation that led to the automated collection of data on vehicle owners. The incident, already reported in recent days in other cantons, appears not to be related to an intrusion into the cantonal administration's IT infrastructure.

The theft involved information that, according to federal regulations, can be accessed through the online license plate lookup service. The data collected included the license plate number, the owner's first and last name, and their address.

However, the data of people who had previously requested that their information not be made public are excluded from the operation.

Abusive use of the online service

The Ticino License Plate List system allows, within the limits established by law, to obtain certain information based on a vehicle's registration number. This service is designed for individual consultation, not for systematic collection of information.

According to the authorities, this very possibility was abused. The attackers allegedly used the search form in an automated manner, performing a large number of queries and intentionally bypassing the mechanisms designed to limit requests.

The incident therefore falls within a type of attack that doesn't necessarily require direct penetration of an administration's IT systems. Rather, the goal was to exploit a legitimately accessible service to extract, on a large scale, information that, individually, is public.

Ticino has deactivated the list

The Traffic Section had already begun to address the situation last week, contacting the service provider and the authorities of the other affected cantons.

Once the involvement of Ticino data was confirmed, the Department of Institutions, through the Traffic Section, filed a criminal complaint against unknown persons with the Public Prosecutor's Office.

Meanwhile, as a precautionary measure, the "Ticino Canton License Plate List" webpage has been disabled . The suspension is intended to prevent further misuse of the tool while investigations are conducted into the incident and the methods used to collect the license plates.

The incident is therefore not described as a breach of the canton's IT systems. The key issue concerns the automated abuse of a service that makes certain information on vehicle owners available, in compliance with current legislation.

No ransom for the perpetrators of the attack

Another factor concerns the potential financial demands that could accompany the data theft. Ticino, in line with the position taken by the other cantons involved, does not intend to pay ransoms.

The authorities' position is based on two considerations: paying money does not guarantee that the information will actually be deleted and, at the same time, it risks financing the perpetrators of the attack, incentivizing them to continue similar activities.

This issue is particularly important because the stolen information could be valuable for fraudulent activities or targeted contact campaigns. Having a name, address, and license plate number can enhance the credibility of communications crafted to appear to originate from authorities or public services.

Beware of fines and suspicious payments

This is one of the aspects to which the Ticino authorities are most keenly drawing the public's attention. Data theft doesn't automatically mean that every data subject will be a victim of fraud, but it does make it advisable to exercise particular caution when faced with unexpected communications.

Letters, emails, and text messages asking for a quick payment or personal or financial information therefore deserve scrutiny, especially when they refer to alleged fines, road taxes, roadworthiness tests, or tolls incurred abroad.

We recommend not using the contact information contained in the message received if you have any doubts about its authenticity. Instead, it's best to contact the relevant authority or service directly, using official channels only.

The risk of phishing after data theft

The availability of real information can make phishing attempts more insidious . A fraudulent message containing a person's correct name, address, or plausible reference to a vehicle may appear more credible than a generic communication.

For this reason, caution isn't limited to obviously unusual requests. Even seemingly personalized communications should be checked before proceeding with a payment, clicking a link, or submitting banking and personal information.

In particular, the presence of elements such as a tight deadline, the threat of a penalty, or a request to act immediately represents a further reason to interrupt the procedure and independently verify the origin of the request.

A case involving several cantons

Ticino's involvement must be viewed in the context of a problem that does not concern the cantonal administration alone. Coordination with the other affected cantons and with the service provider is part of the efforts undertaken to understand the extent of the theft and the methods used.

The case also highlights a broader issue related to the online availability of public data. Just because certain information can be legitimately accessed doesn't mean it can be collected without restrictions or used for purposes other than those intended.

Automation, in fact, changes the scale of the phenomenon: an individual consultation and a systematic collection of thousands of records represent profoundly different situations, even when the initial access occurs through the same tool.

Investigations still ongoing

With the complaint filed with the Public Prosecutor's Office, the matter has also entered the legal stage. Ticino authorities have so far confirmed the involvement of vehicle owners' data, but have clarified that there was no intrusion into the canton's IT systems.

The temporary deactivation of the license plate list is a precautionary measure. Attention is now focused on reconstructing the attack, the amount of information collected, and the potential consequences for those involved.

For citizens, the main immediate advice remains to carefully check any unexpected request for money or personal information. When in doubt, the contact person should always be the competent authority, not the contact information provided in the communication received.