Federal probe into tourism data access raises oversight questions

In late August, the Costa Mar Tourism Ministry discovered that its central database—containing visitor records, booking histories, and operational data from eco-tourism operators—had been accessed without authorization over a period of several weeks. The intrusion was detected by routine audit logs and reported to the Federal Interior Ministry. The investigation is now in its second month, and while the scope of the breach remains unclear, it has raised fundamental questions about how the federal government ensures data security across its regions.

The breach itself was not catastrophic. No evidence has emerged that personal visitor information was copied or sold. No operators' financial records were altered. But the fact that unauthorized access occurred at all—and went undetected for weeks—has alarmed federal officials and regional administrators alike. The Costa Mar Tourism Ministry operates on federal IT infrastructure; the security protocols are supposed to be uniform across all regions. Yet the breach suggests those protocols may have gaps.

The investigation has identified three separate access points through which the unauthorized queries occurred. Two were traced to external IP addresses; one appeared to originate from within the ministry's own network. Federal investigators have not yet identified who performed the access or what specific information was sought, though preliminary analysis suggests the queries focused on visitor-arrival patterns and seasonal booking data—information that would be valuable to competitors or to actors seeking to understand tourism flows into the region.