Nasa became the last major organization to suffer a cyber attack after an internal memo revealed that information about its employees had been leaked.
In a message to the workers on Tuesday, the US Space Agency said that two of its severs had been accessed by an unauthorized party on 23 October.
The memo, posted by the SpaceRef science news site, shows that the severs contained information about current and former employees, including social security numbers.
“Nasa continues its efforts to secure all servers and reviews its processes and procedures to ensure that the latest security practices are followed throughout the agency,” said Bob Gibbs, the company’s assistant administrator.
He added that the agency works with “cyber security partners “to investigate the extent of the data breach and to determine which staffs were affected by the attack.
Speaking to The Independent, Sam Curry, Chief Security Officer at the Cybereason security firm, said Nasa’s first priority was ” to limit harm and help the victims while also ensuring that the breach is remedied, but then it’s time to enter the more painful phase of the mission and learn from the results. ” However, this is not the first time that the space agency has been involved in a cyber-security scandal.
In 2012, Nasa Inspector General Paul K Martin told US lawmakers that hackers had “full functional control ” of key computers of the agency in 2011 and were able to ” modify, copy or delete sensitive files, ” reports the BBC. Martin claimed that between 2010 and 2011, the agency suffered “5,408 computer security incidents.”
He added that the agency is a “target – rich cyber-attack environment.” People are motivated by “testing their ability to break into Nasa systems, to well-organized criminal enterprises that hack for profit, to intrusions that foreign intelligence services may have sponsored.”
The Nasa attack follows other major breaches of data in 2018, including the November leaks of Marriott Starwood and the September hack of British Airways.
Who’s impacted?
Personnel employed by Nasa between July 2006 and October 2018 may have had their data disclosed by the attack, although the company was unable to determine whether hackers stored any personal data.
In addition to exposing social security numbers, the agency claims that personally identifiable information (PII), a broad term that could include anything from the date of birth to the passport number of a person, could also be “exfiltered”.
Nasa urged workers to “take the precautions necessary to prevent possible identity theft, “Gizmodo says.
It was not revealed why Nasa waited for two months to go public on the hack. However, the ZDNet technology news site says that it is “common “for authorities in the United States to ask hacked organizations to “delay notifying victims while investigating an incident.”
Has missions been compromised?
Not right now, no. Nasa said that “does not believe that cyber incidents have jeopardized any agency missions.”
