Czech business registry security flaw exposed personal identification numbers

A technical error in a test version of Czechia's online business registry made personal identification numbers accessible through the website's underlying data, according to an investigation by Czech Radio. The issue was identified in September, and the Ministry of Justice subsequently took the affected platform offline.

The problem concerned a publicly accessible test version of a redesigned business registry, rather than the existing public registry used to look up Czech companies and organizations.

The incident was first reported by iROZHLAS in September, with a follow-up published on October 13 examining the potential extent of the issue and the authorities' response.

The error involved information returned by the website's server when users searched for people associated with registered companies and organizations.

Although the information was not displayed in ordinary search results, it could be accessed by examining the technical data exchanged between the website and its server.

This included rodná čísla, the personal identification numbers used in Czech administration, as well as other identifiers used within government information systems.

Czech Radio journalists were able to reproduce the issue, demonstrating that the information was technically accessible.

According to the broadcaster, the number of individuals whose information could potentially have been accessible may have been substantial. However, the precise scope of the exposure has not been established.

Importantly, there is no public confirmation that the information was collected or misused on a large scale.

After being informed of the problem, the Ministry of Justice restricted access to the affected system and subsequently shut down the test platform.

In its official response, the ministry emphasized that the information was not visible through normal use of the website and that accessing it required examining technical server responses.

The matter was also referred to the Office for Personal Data Protection and the National Cyber and Information Security Agency for further review.

As highlighted in Czech Radio's October 13 follow-up, questions remain about how long the information was accessible and whether it was obtained by anyone beyond those who identified the problem.

The existing public business registry continues to operate, and the reported error concerned the separate test version.

For business owners and others whose information appears in Czech company records, the incident highlights the importance of protecting personal identifiers in public-sector digital systems. Authorities have not established that the exposed information was misused.