Pharmacy vaccination certificates stopped for the time being

Maximilian Reindl studied chemistry and biochemistry at the LMU in Munich and has been a member of the editorial team since December 2020. He will familiarize himself with medical, scientific and health policy topics for you in order to make them understandable and comprehensible.

More posts by Maximilian Reindl All content is checked by medical journalists.

Pharmacies have been offering digital vaccination certificates since mid-June. However, this offer has now been stopped for the time being. The reason for this is a weak point in the allocation of internal access. For example, unauthorized persons could pretend to be a pharmacy with forged documents in order to gain access to the dispensing system. It is currently not clear when pharmacies will issue vaccination certificates again.

Digital vaccination certificates are available again in some pharmacies. You can find out in advance on the portal www.mein-apothekenmanager.de which pharmacy in your area is offering this service again.

(This text was updated on July 30th, 2021, according to a press release from the pharmacy umbrella organization ABDA.)

Why do pharmacies stop dispensing?

Pharmacies have not been issuing digital corona vaccination certificates since Wednesday. This is a precautionary measure to check other security mechanisms when issuing the certificates, according to a statement from the German Pharmacists' Association (DAV). It is not known how long the award will be suspended.

According to the umbrella association, IT experts from Handelsblatt managed to gain access to the internal vaccination certificate portal for pharmacies without being noticed. This would also make it possible in principle for unauthorized third parties to issue “valid” certificates - regardless of whether a person was actually vaccinated or not.

With the help of forged documents, the IT experts registered themselves as pharmacy owners in the allocation system and issued two certificates as a test. As soon as they were discovered, the “wrong pharmacists” immediately reported the vulnerability to those responsible.

Has user data flowed out?

There is currently nothing to indicate that user data has leaked as a result of the vulnerability. A preliminary internal check also found no further unauthorized access to the system.

In consultation with the Federal Ministry of Health, the German Pharmacists' Association (DAV) nevertheless stopped issuing certificates for the time being in order to be able to investigate the matter in more detail. The aim is to further secure the allocation of guest access against unauthorized persons.

Are vaccination certificates that have already been issued valid?

Yes. The umbrella organization assumes that the around 25 million vaccination certificates issued so far are valid. Since no further third-party access has been detected so far, all certificates have been generated by legally registered pharmacy owners.

It is currently not clear when pharmacies will issue vaccination certificates again after the issuance stop.

How do pharmacies get their access?

Access to the internal allocation system is organized by the German Pharmacists' Association (DAV). In order to be able to issue vaccination certificates, a pharmacy must first register. The portal currently has around 17,900 registered pharmacies.

For association members, all documents required for registration are already available in the membership directory. “Free pharmacies” that are not members of a regional pharmacy association can in turn apply for guest access. The documents required for this include an official operating permit and a current notification from the night and emergency service, which confirms ongoing operations. According to the DAV, there are currently around 470 guest pharmacies.

And unauthorized access to the allocation system took place via such a guest account. Now those responsible are checking which other security rules can prevent this in the future.

Further information on digital corona vaccination certificates can be found here.

Tags:  symptoms menshealth palliative medicine