We usually trust official city apps, but as a recent incident involving Bratislava’s PAAS parking system shows, that’s not always a good idea. The phone numbers of more than 17,000 users were freely accessible online for over a year.
What happened?
User data from Bratislava’s PAAS parking payment app was leaked online. Files containing phone numbers and mobile carrier names were accessible to anyone for over a year in an open repository on GitHub—a platform for developers where city authorities publish technical documentation and the source code for their programs.
Mayoral candidate Ľubomír Geci was the first to notice the problem and reported the discovery on social media. He downloaded and analyzed the data: after removing duplicates, the file contained 17,616 unique phone numbers. To prevent scammers from immediately exploiting the data, he did not publish the exact link to the files.
The City Council’s Response and Investigation
The Bratislava City Council officially acknowledged the data leak. According to them, access to the file was blocked immediately upon receiving notification of the problem on October 22.
“We immediately took steps to permanently delete the file from the GitHub repository. At the same time, we checked all other public folders and found no other leaks,” said representatives of the city council.
City officials claim they conducted a thorough audit of all their digital repositories but found no other compromised data. Nevertheless, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR) is already investigating the incident. The agency is determining the extent of the legal violation and its potential consequences.
What are the risks for users?
There is currently no evidence that fraudsters have already exploited this database, but the risks to users are high. Phone numbers are exactly what cybercriminals need for phishing and spam. PAAS app users should be especially vigilant in the coming days.
Main threats:
- Phishing SMS messages. Scammers may send fake messages about alleged unpaid parking fines with a link to a fraudulent payment gateway.
- Suspicious calls. Attackers may call, posing as bank employees, police officers, or PAAS system representatives, in an attempt to trick you into revealing payment card details or access to your bank accounts.
- Spam and unsolicited advertising. Numbers from the database may be sold for mass advertising campaigns.
What should you do, and how can you protect yourself?
The best protection right now is caution. If you use the PAAS system, follow these security rules:
- Do not trust unknown messages. Never click on links in text messages if you are not sure who sent them. Always check information about fines or outstanding balances directly in the official PAAS app.
- Do not share your card details with anyone. Employees of banks or government agencies will never ask for your PIN, CVV code, or full card number over the phone.
- Verify the information. If you receive a call regarding financial matters, end the conversation and call your bank’s official hotline or the relevant service yourself.
- Be skeptical. If an offer or request sounds too suspicious or requires immediate action, it’s likely a scam.
According to Slovak media reports, the investigation into the incident is ongoing, and users are advised to remain vigilant.
