Politico | US nuclear weapons agency breached amid massive cyberattack
- Hackers accessed systems at the National Nuclear Security Administration, which maintains the US nuclear weapons stockpile
- The perpetrators are believed to have gained access to the federal agencies’ networks by compromising the software company SolarWinds
This story is published in a content partnership with POLITICO. It was originally reported by Natasha Bertrand on politico.com on December 17, 2020.
The Energy Department and National Nuclear Security Administration, which maintains the US nuclear weapons stockpile, have evidence that hackers accessed their networks as part of an extensive espionage operation that has affected at least half a dozen federal agencies, officials directly familiar with the matter said.
On Thursday, DOE and NNSA officials began coordinating notifications about the breach to their congressional oversight bodies after being briefed by Rocky Campione, the chief information officer at DOE.
They found suspicious activity in networks belonging to the Federal Energy Regulatory Commission (FERC), Sandia and Los Alamos national laboratories in New Mexico and Washington, the Office of Secure Transportation and the Richland Field Office of the DOE. The hackers have been able to do more damage at FERC than the other agencies, the officials said, but did not elaborate.
Federal investigators have been combing through networks in recent days to determine what hackers had been able to access and/or steal, and officials at DOE still do not know whether the attackers were able to access anything, the people said, noting that the investigation is ongoing and they may not know the full extent of the damage “for weeks”.
Spokespeople for DOE did not immediately respond to requests for comment.
The attack on DOE is the clearest sign yet that the hackers were able to access the networks belonging to a core part of the US national security enterprise. The hackers are believed to have gained access to the federal agencies’ networks by compromising the software company SolarWinds, which sells IT management products to hundreds of government and private-sector clients.
DOE officials were planning on Thursday to notify the House and Senate Energy committees, House and Senate Energy and Water Development subcommittees, House and Senate Armed Services committees, and the New Mexico and Washington state delegations of the breach, the officials said.
The FBI, Cybersecurity and Infrastructure Security Agency, and Office of the Director of National Intelligence acknowledged the “ongoing” cybersecurity campaign in a joint statement released on Wednesday, saying that they had only become aware of the incident in recent days.
How hackers used obscure IT vendor to attack top US agencies
“This is a developing situation, and while we continue to work to understand the full extent of this campaign, we know this compromise has affected networks within the federal government,” the statement read.
NNSA is responsible for managing the nation‘s nuclear weapons, and while it gets the least attention, it takes up the vast majority of DOE’s budget.
Similarly, the Sandia and Los Alamos National Labs conduct atomic research related to both civil nuclear power and nuclear weapons. The Office of Secure Transportation is tasked with moving enriched uranium and other materials critical for maintaining the nuclear stockpile.
Hackers may have been casting too wide a net when they targeted DOE‘s Richland Field Office, whose primary responsibility is overseeing the clean-up of the Hanford nuclear waste site in Washington state. During World War II and the Cold War, the US produced two- thirds of its plutonium there, but the site has not been active since 1971.
The attack on the Federal Energy Regulatory Commission may have been an effort to disrupt the nation‘s bulk electric grid. FERC does not directly manage any power flows, but it does store sensitive data on the grid that could be used to identify the most disruptive locations for future attacks.
Read Politico’s story.
