A background investigation firm with OPM, DHS, and other federal agency contracts notified the government that it identified an unlawful breach of its network. In a statement posted on the website today, USIS noted that it was working with the government to determine the ‘nature and extent’ of the attack. They acknowledged that it appeared to be a state-sponsored attack.
“Cybercrime and attacks of this nature have become an epidemic that impacts businesses, government agencies, and financial and educational institutions alike,” the statement posted on the USIS Website said. “The protection and safeguarding of our networks, our data and the data of our customers is always of the utmost importance, and we have invested heavily in security measures. Our systems and people identified this attack, and, in response, we are working alongside OPM, the Department of Homeland Security (DHS) and federal law enforcement authorities in redoubling our cyber security efforts. We are working collaboratively with OPM and DHS to resolve this matter quickly and look forward to resuming service on all our contracts with them as soon as possible.”
The firm is already under fire for allegations of contractor misconduct. The Justice Department sued the company earlier this year for poor oversight of security clearance investigations, and a White House panel investigated bonuses received by USIS executives.
Just last month hackers were able to gain access to some OPM databases prior to being detected, and shut-down. Officials are confirming the breach, but aren’t yet saying who was responsible and what, if anything, was stolen.
The announcement from USIS also came the day after a U.S. security firm announced that Russian hackers had stolen over 1 billion user names and passwords. For security cleared professionals, these attacks should be a reminder that state-sponsored hacking is often linked back to foreign intelligence efforts, and attacks such as these will certainly result in increased phishing attacks against cleared professionals. Also be aware that stolen user name and password combinations may also be used to create fake profiles on public facing social networking sites, so be aware of where your name and likeness appear online.
