DOE CYBER SECURITY BREACH WORSE THAN INITIALLY THOUGHT

Mike Nartker
GHG Monitor
10/18/13

A cyber security breach that occurred at the Department of Energy in late July impacted significantly more employees than initially believed, according to a message DOE sent employees late last week. An ongoing investigation into the incident has found that the personal information of more than 104,000 current and former federal employees, contractor workers and dependents was compromised, of which 64,480 “are personnel within our direct DOE Federal and M&O Contractor community, including spouses, dependents and former employees,” says the message from Chief of Staff Kevin Knobloch. DOE had initially estimated that approximately 14,000 current and former employees had been affected by the incident. Knobloch also said the investigation has found that the bank account numbers used for salary direct deposit for approximately 2,800 employees have also been compromised.

A criminal investigation into the incident remains ongoing, as does a DOE Inspector General’s Office management review “of the facts leading up to the attack and compromise of the MIS application and the applications and databases to which it connects,” Knobloch said. “The Department continues to examine and strengthen the policies and systems in place to protect our repositories of sensitive personal information,” Knobloch said. “Where appropriate, new protections are being put in place to further strengthen our cyber defenses and restrict unauthorized disclosure. As is always the case, we must all be vigilant not to collect, store or otherwise retain sensitive personal information that is not absolutely required for doing DOE business.”

In a written response late this week, a DOE spokesperson said, “As with most large organizations, the Energy Department uses a management information system to provide Department employees access to internal human resources and administrative resources. The Department continues to work closely with the IG and law enforcement to investigate the cyber attack and to examine and strengthen policies and systems that protect sensitive personal information and restrict unauthorized access and disclosure.” For its part, the DOE Inspector General’s Office said that its management review is “in progress” and that “at this time, we do not have a projected date of completion.” In his message, Knobloch said DOE is making available to all of those people impacted by the incident a free one-year subscription to a credit monitoring service. DOE has also purchased a family care and protection plan “that will monitor the social security numbers for children and youth who do not yet have a credit history,” Knobloch said.