Associated Press in Washington
theguardian.com, Friday 22 August 2014 20.48 EDT
Anonymous official says number could be even greater as department warns employees to check bank accounts
The internal records of as many as 25,000 employees of America’s Department of Homeland Security (DHS) were exposed during a recent computer hack at a federal contractor that handles security clearances, an agency official said on Friday.
The official, speaking anonymously, said the number of victims could be greater. The incident is under active federal criminal investigation.
The department was informing employees whose files were exposed in the hacking against contractor USIS and warning them to monitor their financial accounts.
Earlier this month, USIS acknowledged the break-in, saying its internal cybersecurity team had detected what appeared to be an intrusion with “all the markings of a state-sponsored attack”.
Neither USIS nor government officials have speculated on the identity of the foreign government.
USIS, once known as US Investigations Services, has been under criticism in Congress in recent months for its performance in conducting background checks on National Security Agency systems analyst Edward Snowden and on Aaron Alexis, a military contractor employee who shot 12 people dead in Washington in September 2013.
Private contractors perform background checks on more than two-thirds of the 4.9 million government workers with security clearances, and USIS handles nearly half of that number.
It is not clear when the hacking took place, but DHS notified all its employees internally on 6 Aug.
At that point, DHS issued “stop-work orders” preventing further information flows to USIS until the agency was confident the company could safeguard its records.
At the same time, the Office of Personnel Management (OPM) temporarily halted all USIS background check fieldwork “out of an abundance of caution,” spokeswoman Jackie Koszczuk said.
Officials would not say whether workers from other government agencies were at risk. DHS will provide workers affected by the intrusion with credit monitoring.
The risk to as many as 25,000 DHS workers was first reported on Friday by Reuters.
A cybersecurity expert, Rick Dakin, said the possibility that other federal departments could be affected depends on whether the DHS records were “segmented, or walled off, from other federal agencies’ files inside USIS.
“The big question is what degree of segmentation was already in place so that other agencies weren’t equally compromised,” said Dakin, chief executive of Coalfire, a major IT audit and compliance firm.