The Magnitude of the Breach
On Thursday, June 4, it was announced that there was a large breach of the Office of Personnel Management (OPM) of the federal government. The Chinese are fingered in the breach, in which about 4 million people’s records were lost in the attack, and the Chinese government denied being responsible, as it does routinely. But think about the data which has been stolen – PII (personally identifiable information). That PII included JOB HISTORY – of federal employees. With deep job history, it greatly increases the hacker’s ability to spear phish (send highly targeted email attacks to gain access to sensitive data) successfully. If they are successful with someone high up in the DOD, what could they gain access to? What about the White House? State Department? Department of Homeland Security? Nuclear Regulatory Agency? The target smacks of a state sponsored attack, as do the methods, servers and hacker habits.
Attacks targeting federal workers are not new – federal contractor KeyPoint had 40k federal employee records breached in December, 2014 and rival contractor United States Investigative Services lost its investigations business with the government following a cyberattack earlier in 2014. That breach tainted the files of at least 25,000 Homeland Security workers. China was fingered in those attacks as well.
