U.S. government agencies latest target in global hacking campaign: cyber watchdog

The U.S. Department of Energy and several other federal agencies were hit in a global hacking campaign that exploited a vulnerability in widely used file-transfer software, officials said on Thursday.

Data was “compromised” at two entities within the energy department when hackers gained access through a security flaw in MOVEit Transfer, the department said in a statement.

A DOE official said those entities were the DOE contractor Oak Ridge Associated Universities, and the Waste Isolation Pilot Plant – the New Mexico-based facility for disposal of defense-related nuclear waste.

British energy giant Shell, the University System of Georgia, the Johns Hopkins University and the Johns Hopkins Health System were also hit, all three groups said in separate statements. The latter is a nonprofit that collaborates with the university and runs six hospitals and primary care centers.

The new victims add to a growing list of entities in the U.S., Britain and other countries whose systems were infiltrated through the MOVEit Transfer software. The hackers took advantage of a security flaw that its maker, Progress Software, discovered late last month.

5:59 New study shows students think educational institutions lack cyber security safeguards

The Russia-linked extortion group Cl0p, which has claimed credit for the MOVEit hack, earlier said in a statement that it would not exploit any data taken from government agencies, and that it had erased all such data. It did not immediately respond to a request for further comment.

Get daily National news

Get the day's top news, political, economic, and current affairs headlines, delivered to your inbox once a day.

Sign up for daily National newsletter Sign Up

By providing your email address, you have read and agree to Global News' Terms and Conditions and Privacy Policy.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said it was helping several federal agencies that had been breached, but did not name them.

“At this time, we are not tracking any significant impacts to the federal civilian executive branch (.gov) enterprise but are continuing to work with our partners on this issue,” the agency said in a statement.

The energy department, which manages U.S. nuclear infrastructure and energy policy, said it had notified Congress of the breach and is participating in investigations with law enforcement and CISA.

A Shell spokesperson said there was no evidence of impact to Shell’s core IT systems from the MOVEit Transfer-related breach. “There are around 50 users of the tool, and we are urgently investigating what data may have been impacted,” she added.

4:30 Canada to establish cyber security program alongside US to protect defence supply chain, Anand says

Johns Hopkins also said it was “investigating a recent cybersecurity attack targeting a widely used software tool that affected our networks.”

The University System of Georgia, which groups about 26 public colleges, said it was “evaluating the scope and severity of this potential data exposure” from the MOVEit hack.

Large organizations including the UK’s telecom regulator, British Airways, the BBC and drugstore chain Boots emerged as victims last week.

CISA did not immediately respond to requests seeking further comment. The FBI and National Security Agency also did not immediately respond to emails seeking details on the breaches.

1:22 Canada remains ‘steadfast’ in support for Ukraine despite alleged Russian cyber-attacks: Trudeau

A MOVEit spokesperson said the company had “engaged with federal law enforcement” and was working with customers to help them apply fixes to their systems.

Progress Software’s shares ended down 6.1% on Thursday. The company disclosed another “critical vulnerability” it found in MOVEit Transfer on Thursday, although it was not clear whether it had been exploited by hackers.

MOVEit Transfer is a popular tool used by organizations to share sensitive information with partners or customers. It could be used by a bank’s customers, for instance, to upload their financial data for loan applications, said John Hammond, a security researcher at Huntress.

“There’s a whole lot of potential for what an adversary might be able to get into,” he said earlier this month.

(Reporting by Raphael Satter and Kanishka Singh in Washington; Zeba Siddiqui in San Francisco; Shivani Tanna and Chandni Shah in Bengaluru; editing by Jonathan Oatis, Angus MacSwan, Bill Berkrot and Cynthia Osterman)