Energy Department among federal agencies breached by Russian ransomware gang

Russian Ransomware Gang Breaches Energy Department and Other Federal Agencies

On Thursday, Homeland Security officials announced that the Department of Energy, along with several other federal agencies, fell victim to a global hack orchestrated by a Russian cyber-extortion gang. The breach exploited a popular file-transfer program used by corporations and governments, but officials stated that the overall impact was expected to be minimal.

While the hack initially seemed relatively inconsequential, it gradually revealed significant implications as it affected patrons of at least two state motor vehicle agencies. However, Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, reassured reporters that unlike the sophisticated and protracted SolarWinds hacking campaign, which was attributed to Russian state-backed intelligence agents, this attack was brief, superficial, and quickly identified.

Easterly stated, “Based on discussions we have had with industry partners, these intrusions are not being leveraged to gain broader access, to gain persistence into targeted systems, or to steal specific high-value information. In summary, as we understand it, this attack is largely opportunistic.”

She further emphasized that although the campaign was a cause for concern, it did not pose a systemic risk to national security or the country’s networks, unlike the SolarWinds incident. A senior official from the Cybersecurity and Infrastructure Security Agency confirmed that the U.S. military and intelligence community remained unaffected. The spokesperson for the Department of Energy, Chad Smith, acknowledged that two entities within the agency were compromised but did not provide additional details.

The list of known victims includes various organizations such as Louisiana’s Office of Motor Vehicles, Oregon’s Department of Transportation, the Nova Scotia provincial government, British Airways, the British Broadcasting Company, and the U.K. drugstore chain Boots. The targeted program, MOVEit, is widely used by businesses to securely share files, potentially including sensitive financial and insurance data.

Louisiana officials disclosed that individuals with a driver’s license or vehicle registration in the state likely had their personal information exposed. This included details like their name, address, Social Security number, and birthdate. The officials urged Louisiana residents to freeze their credit to safeguard against identity theft. Similarly, the Oregon Department of Transportation confirmed that the attackers accessed personal information, including some sensitive data, of approximately 3.5 million individuals who were issued identity cards or driver’s licenses by the state.

The Cl0p ransomware syndicate, responsible for the hack, issued a statement on its dark web site, notifying its victims, potentially numbering in the hundreds, that they had until a specified deadline to negotiate a ransom. Failure to comply would result in the syndicate publicly releasing the stolen data. The gang, one of the most prolific cybercrime syndicates globally, claimed that they would delete any data stolen from governments, cities, and police departments.

Regarding the impact on federal agencies, the senior official from the Cybersecurity and Infrastructure Security Agency mentioned that only a “small number” were affected but refrained from naming them. They clarified that it was not a widespread campaign affecting numerous federal agencies. The official, speaking anonymously, stated that no federal agencies had received extortion demands, and Cl0p had not leaked any data from the affected agencies online.

U.S. officials confirmed that there was no evidence indicating coordination between Cl0p and the Russian government.

Progress Software, the parent company of MOVEit’s U.S. manufacturer, notified customers of the breach and released a patch on May 31. However, cybersecurity researchers noted that by that time, scores, if not hundreds, of companies may have already had their sensitive data exfiltrated.

The senior official from the Cybersecurity and Infrastructure Security Agency stated, “At this point, we are seeing industry estimates of several hundred victims across the country.” Federal officials encouraged all victims to come forward, although disclosure of hacks varies by state since the U.S. lacks a federal data breach law. However, publicly traded corporations, healthcare providers, and some critical infrastructure providers have regulatory obligations to report such incidents.

SecurityScorecard, a cybersecurity firm, reported detecting 2,500 vulnerable MOVEit servers across 790 organizations, including 200 government agencies. They were unable to provide a breakdown of the affected agencies by country.

The Office of the Comptroller of the Currency in the Treasury Department uses MOVEit, according to federal contracting data. A spokesperson stated that the agency was aware of the hack, closely monitoring the situation, and conducting forensic analysis to ensure there was no breach of sensitive information. However, they did not disclose how the agency utilized the file-transfer program.

The hackers were actively scanning for targets, gaining unauthorized access, and stealing data as early as March 29, as per Jared Smith, a threat analyst from SecurityScorecard.

This incident is not the first time Cl0p has breached a file-transfer program to obtain access to data for extortion purposes. They previously targeted GoAnywhere servers in early 2023, as well as Accellion File Transfer Application devices in 2020 and 2021.

When contacted for information on the government agencies they had hacked, Cl0p did not respond. However, the gang posted a new message on their dark web leak site, stating, “We got a lot of emails about government data, we don’t have it. We have completely deleted this information. We are only interested in business.”

Cybersecurity experts advise against trusting the Cl0p criminals to keep their word. Some incidents have occurred where data stolen by ransomware groups appeared on the dark web six to ten months after victims paid the ransom.

Reporters Sara Cline in Baton Rouge, Louisiana, Eugene Johnson in Seattle, and Nomaan Merchant and Rebecca Santana in Washington contributed to this report.

Frequently Asked Questions (FAQs) about Ransomware

More about Ransomware

• Department of Energy among federal agencies breached by Russian ransomware gang
• Cybersecurity and Infrastructure Security Agency (CISA)
• SolarWinds hack: A timeline of the breach
• Cl0p ransomware: Everything you need to know
• SecurityScorecard
• Information on data breaches and identity theft protection
• Ransomware attacks: What to do if you become a victim
• Tips for preventing identity theft
• The dangers of paying ransoms to ransomware attackers