(Bloomberg) -- The US Department of Health and Human Services was ensnared by a sweeping hacking campaign that exploited a flaw in file-transfer software called MOVEit, according to an official with the department.
Most Read from Bloomberg
-
Xi’s Metal Curbs Risk Backfiring as G-7 Seeks China Alternative
-
Lazard Fires Senior Banker for Inappropriate Behavior at Party
-
China Restricts Export of Chipmaking Metals in Clash With US
-
Stocks Decline as China Data Saps Risk Sentiment: Markets Wrap
The attackers gained access to data by exploiting MOVEit software used by third-party vendors, the official said, adding that no HHS systems or networks were compromised. Congress was notified of a “major incident” on June 27, according to the official, indicating it may involve exposure of data from 100,000 or more people.
However, HHS has no evidence to suggest internal email communications have been compromised, the official said.
HHS leadership believe the hackers to be a Russian-speaking group called Clop, the gang that has claimed responsibility for the MOVEit attacks, according to two other people familiar with the incident. The HHS official and the two people asked not to be identified because the details aren’t public.
The vulnerability allowed the hackers to steal files from companies and organizations that had been uploaded to MOVEit.
Among the other companies and organizations that were impacted are Ernst & Young, Honeywell, the government of Nova Scotia, the New York City Department of Education and the Louisiana Office of Motor Vehicles, where names, addresses, social security numbers and dates of birth were likely exposed for all Louisianans with a state-issued license. Brett Callow, a threat analyst at the cybersecurity firm Emsisoft, tweeted Wednesday that 137 organizations are known to have been affected by the MOVEit attacks, compromising the records of more than 15 million people. That includes 16 entities in the US public sector, he said.
Several federal agencies “experienced intrusions affecting their MOVEit applications,” a US official said earlier this month, without naming them. Since then, further details have trickled out about the impact on the US government.
For instance, the US Department of Energy received ransom requests from the hackers after two of its entities fell victim to the intrusions.
A spokesperson for the US Department of Agriculture, in response to questions about the MOVEit breach, said fewer than 30 employees may have been impacted through a third-party vendor data breach. The USDA’s network wasn’t affected, the spokesperson said.