Directorate of File Automation

Summary

The Green Blood Group breached two servers at the Directorate of File Automation, exfiltrating biometric data, immigration records and birth certificates belonging to nearly twenty million residents. The attackers claimed to have taken 139 gigabytes of information, which they later posted on a dark web leak site, prompting the agency to halt new national ID card production and acknowledge the incident after the leak appeared. The intrusion disrupted operations for at least five days, affecting the domain controller and a personal data server, and raised concerns about the confidentiality and trust in the state’s digital identity system.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 19, the ransomware group known as the Green Blood Group breached two servers operated by Senegal’s Directorate of File Automation (DAF), the agency responsible for passports, national ID cards and biometric data for the country’s nearly 20 million residents. According to an email sent the following day by IRIS employee Quik Saw Choo, the compromised systems were the organization’s domain controller and a “Perso” server believed to hold citizens’ personal information. Choo noted that IRIS had taken several measures to cut off the attackers, but those actions did not prevent the intruders from maintaining access long enough to exfiltrate data. The Gambia Journal reported that the breach disrupted DAF operations for at least five days, a disruption that may have been self‑imposed as part of the response. On February 4, security analysts discovered the group’s leak site on the Dark Web, where it claimed to have stolen 139 TB of data; the group’s own ransom note to DAF referenced 139 GB, a figure later examined by French‑Senegalese cybersecurity influencer Clement Domingo, who confirmed that the stolen material included genuine birth records, national ID cards and other ultra‑sensitive information. More than two weeks after the initial intrusion, on February 5, DAF publicly acknowledged the incident, issuing an open letter that cited a generic Yahoo address for contact, announced a temporary halt to new national ID card production and asserted that the integrity of the data remained intact—a claim Domingo questioned—while not addressing the confidentiality breach.

The article notes that the Green Blood Group, though newly emerged, had previously compromised organizations in Colombia and India and was described by researchers at Foresiet as a technically competent gang with a mature ransomware design, a Golang‑based locker and a double‑extortion model. Following the biometric data leak, another Senegal‑government‑linked entity, Sénégal Numérique SA, which manages the state’s digital infrastructure and modernization efforts, reportedly fell victim to a cyberattack, with local outlets speculating that the timing might indicate a broader offensive; Dark Reading sought comment from the company to verify the incident. The piece also provides background on Senegal’s national biometric ID system, noting that the government first proposed it in early 2015, awarded implementation to Malaysian firm IRIS Corporation Berhad in late 2016, and that by 2026 more than seven million citizens had obtained biometric IDs according to IRIS, with the actual number likely higher. Statements from Aboubacar Yacouba Mai Birni, chief operations officer of the Africa Cybersecurity Resource Center, are included, describing the breach as reflective of a wider African challenge where digital ambition outpaces cybersecurity maturity, warning that loss of public trust could hinder future digital initiatives, financial inclusion, e‑government and economic digitalization efforts. No recommendations, mitigation advice or speculative conclusions are offered beyond the reported facts and quoted remarks.

Sources

Sources available to members: 1 source.