Security audits have identified significant vulnerabilities in the Schengen Information System II (SIS II), the European Union’s largest border surveillance database. According to reports reviewed by Bloomberg and Lighthouse Reports, thousands of security flaws remain unpatched, some of them dating back several years. The European Data Protection Supervisor (EDPS) classified many of the weaknesses as “high risk” in a 2024 assessment.
Scale of Data and System Weaknesses
SIS II has been operational since 2013 and contains about 93 million records, including sensitive biometric data such as fingerprints and facial images. Approximately 1.7 million records relate specifically to individuals, with close to 200,000 flagged as potential security threats. The audits documented a large number of administrator-level accounts within the system, which reviewers highlighted as a particular vulnerability that could expose the system to insider threats.
Among the most serious issues uncovered were outdated software components and technical flaws that had gone unfixed for periods ranging from eight months to over five years. The report singled out the maintenance contractor, Sopra Steria, for delays in addressing known vulnerabilities. The agency responsible for managing the system, eu-LISA, was also criticized for gaps in oversight and follow-up on remediation efforts.
Heightened Risks Ahead of New Border Systems
The findings come as the EU plans to expand its biometric border infrastructure with several major technology rollouts. The Entry/Exit System (EES), scheduled to start phased operation in October of this year, will collect biometric and biographic data on non-EU travelers entering and leaving the Schengen Area. The audits warned that connecting SIS II to this internet-facing system could increase the exposure of sensitive personal data to cybersecurity threats.
Separately, the EU is rolling out a unified biometric matching service known as the sBMS. The first phase of sBMS became operational in May 2025, but further implementation steps are planned through late 2025. The sBMS aims to enable cross-system biometric searches for improved border security and migration management. Meanwhile, individual member states continue to upgrade national systems. For example, Portugal recently launched advanced biometric border control systems at key entry points.
Romain Lanneau, a legal researcher with European civil liberties group Statewatch, warned of the possible consequences if SIS II were compromised. “A breach could be catastrophic, potentially affecting millions of people,” he said, noting that individuals flagged in the system might avoid detection or receive advance notice of law enforcement activity if security gaps remain unaddressed.
The SIS II vulnerabilities come as the EU advances new laws and regulations designed to strengthen data protection and cybersecurity across the bloc. Legislative efforts such as the EU AI Act, the NIS2 Directive, and the Digital Operational Resilience Act (DORA) aim to enforce stricter security standards for systems that handle sensitive data and critical infrastructure.
Sources: Information Security Buzz, ComplianceHub, Statewatch
–
By Cass Kennedy
