Senator: SolarWinds hackers breached ‘dozens’ of Treasury email accounts

"Treasury still does not know all of the actions taken by hackers, or precisely what information was stolen," Sen. Ron Wyden, D-Ore., said after a briefing.

The fallout from a sweeping hacking campaign by suspected Russian operatives continued Monday as Sen. Ron Wyden said that the hackers had breached “dozens of email accounts” of officials at the Treasury Department.

The hackers “broke into systems in the Departmental Offices division of Treasury, home to the department’s highest-ranking officials,” Wyden said after Treasury officials briefed the Senate Finance Committee, where the Oregon Democrat serves as ranking member. “Treasury still does not know all of the actions taken by hackers, or precisely what information was stolen.”

Multiple federal agencies, including the departments of Commerce and Homeland Security, are investigating breaches in the apparent espionage campaign, which has used tampered software made by federal contractor SolarWinds, but also has other vectors for breaking into systems.

The breach at Treasury began in July, and the full extent of it is still unknown, Wyden said in a statement. “Microsoft notified the agency that dozens of email accounts were compromised,” he said.

Asked for comment, a Treasury Department spokesperson referred CyberScoop to Treasury Secretary Steven Mnuchin’s comments to CNBC on Monday that the department had not “seen any large amounts of information displaced” because of the hack, and that the hackers had not broken into classified systems.

Wyden said that, according to the briefing, there was no evidence that taxpayer data at had been compromised.

The scope of the breach at the Commerce Department is gradually being revealed, too. The hackers breached some three dozen email accounts since June at Commerce’s National Telecommunications and Information Administration, a U.S. official familiar with the investigation said. It’s unclear what information they were after, but such email access could be valuable for espionage. The Wall Street Journal first reported on the scope of the NTIA email account breach.

“We can confirm there has been a breach in one of our bureaus,” a Commerce Department spokesperson said. “We have asked CISA [the Cybersecurity and Infrastructure Security Agency] and the FBI to investigate, and we cannot comment further at this time.”

Attorney General William Barr on Monday joined Secretary of State Mike Pompeo in saying evidence points to Russian involvement in the hacking campaign, contradicting President Donald Trump’s evidence-free claim that China could be responsible. Moscow has denied the allegations.

The scope of the potential compromise of the IT supply chain is staggering. Austin-based SolarWinds has numerous clients throughout the Fortune 500, and its software is used in critical infrastructure sectors such as electricity. Nonetheless, Kevin Mandia, whose cybersecurity firm FireEye discovered the hack, estimated that “only about 50 companies or organizations” were the true targets of the suspected intelligence operation.

While investigating the malicious seeding of SolarWinds software updates, researchers found evidence that a second hacking group had deployed code affecting SolarWinds software.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure