Millions affected by cyber attack targeting state and federal agencies

WASHINGTON, D.C. – A data breach affecting millions of citizens occurred in mid-June after a cyber attack targeted an exploit in a popular file transfer software.

An exploit in the MOVEit software developed by Progress Software led to hackers breaching multiple state and federal agencies including the Motor Vehicle Departments in Louisiana and Oregon among others, where customers have had their driver’s license and state ID cards exposed. Carlie Kollath Wells reporting for Axios wrote that roughly 6 million records were compromised in Louisiana, but that it was unclear yet who’s information was stolen or how much.

Cybersecurity & Infrastructure Security Agency (CISA) Director Jen Easterly took to Twitter,  writing, “Although we’re very concerned about this campaign and working it urgently, this is not a campaign like SolarWinds that presents a systemic risk to our national security or our nation’s networks.”

The SolarWinds incident occurred in 2020 where authorities discovered that the SolarWinds program, a network monitoring software used by the federal government was discovered to have a number of security vulnerabilities which led to cyber criminals selling access to the program’s infrastructure since at least 2017. The current exploit affecting systems is being attributed to the CLOP ransomware gang linked to Russia.

Easterly added, “We’re currently providing support to several federal agencies that have experienced intrusions affecting their #MOVEit file transfer applications, though we are not tracking any significant impacts to federal civilian networks at this time.”

Progress Software issued a critical vulnerability advisory while the CISA and FBI issued their own joint cybersecurity advisory addressing the exploit.