Suspected data breach of employment permit online system

A suspected data breach is being investigated after "suspicious activity" was detected on the Employment Permit Online System operated by the Department of Enterprise.

The site is currently unavailable.

The Department said it identified suspicious activity affecting elements of the online portal and as part of preliminary investigations, a security vulnerability was identified.

"The portal was taken offline as a precaution to protect the system while the investigation continues," a spokesperson said.

The Department of Enterprise said it has made an initial notification to the Data Protection Commission as the information potentially exposed includes basic user account information, such as name, email addresses and user account roles (for example employer, agent or employee).

"From preliminary investigations, it appears broader and more sensitive personal data categories have not been affected in the Employment Permits system. The investigation is continuing," the Department said.

The Data Protection Commission (DPC) said it has been notified about the matter.

"The DPC has received a breach notification which is currently being assessed," a spokesperson added.

The Department of Enterprise said the online portal will only be restored when it is satisfied that the necessary security measures are in place and have been independently tested.

The current expectation is that the portal will be restored on Tuesday 3 November.

The Department said the issue is not linked to flaws recently identified with the PHP programming language that saw websites in Ireland and around the world being taken down in order to protect their systems.

A notice on the Employment Permit Online System website states that applications previously submitted continue to be processed and decisions will be issued as normal.

"The Department wishes to advise that future applicants will not be disadvantaged as a result of this temporary outage," according to the notice.

"Applications saved in draft, applications awaiting fee payment and other information held on the system will remain available when the portal returns to service, including applications that may exceed the normal 28-day submission period during the outage," the notice states.

It added that "appropriate flexibility" will apply in cases impacted by the outage.

"The Department of Enterprise, Tourism and Employment sincerely apologises for this unscheduled downtime and any inconvenience caused to users," it states.