Another federal breach exposes employee records

The Energy Department disclosed to Congress on Friday that it suffered a security breach from a hacker in September that compromised 1,500 personnel records.

The news broke just as a House Energy and Commerce Oversight and Investigations Subcommittee was supposed to start a hearing on how secure Energy Department computers are in light of recently reported data breaches at the Internal Revenue Service and Veterans Affairs Department.

Kentucky Republican Ed Whitfield, chairman of the Subcommittee, said there is no excuse for the department to have its current "F" in cyber-security compliance -- or for waiting eight months to tell the Energy secretary or his committee about the security breach.

"It's unbelievable [that] 1,500 personnel files can be compromised with Social Security numbers," Whitfield said. "The impact that can have on individuals is quite disturbing."

Full Energy and Commerce Committee Chairman Joe Barton, R-Texas, visited the hearing room to express his outrage at the data breach and later called Energy Secretary Samuel Bodman. "If the administration won't do something about this incident, this committee will," he said.

While most of the details of the hacking incident were discussed later in executive session, a government agency that tests the department by breaking into its computer system said the attack was at the National Nuclear Security Administration.

NNSA Administrator Linton Brooks said he learned of the "sophisticated" hacking incident in September. He said he did not know whose job it was to tell Bodman, but he wished he had.

"Mr. Brooks, I'm going to recommend you be removed from office, and I think you would do the country a service if you resigned," Barton said. Brooks said that because the breach was labeled a counterintelligence issue, the two sides of the organization each assumed the other had notified the secretary. Barton called that explanation "hogwash."

Energy Chief Information Officer Thomas Pyke said he was aware of various hacking incidents but only learned of the personnel data involved two days ago.

Pyke said the department faces hundreds of thousands of attacks each day. In the event where the records were exposed, he said the attack penetrated both a firewall and a detection system.

Glenn Podonsky, director of the office of security and safety performance assessment, told lawmakers that in November, his team successfully accessed Energy's unclassified computer system. He said they gained access to financial and personal data, and could have impersonated or monitored department executives.

"We basically had domain control," Podonsky said. He said with security improvements made since then that the office could break in but not gain domain control.

He said his office believes Energy is moving too slowly in making security improvements and noted that part of the problem is because of work done by outside contractors.

Whitfield also wanted to know why the Energy Department has failed to report 50 percent of attacks to its computer systems. Podonsky said he agreed they should be reported to help law enforcers track them.

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
FROM OUR SPONSORS
JOIN THE DISCUSSION
Close [ x ] More from GovExec
 
 

Thank you for subscribing to newsletters from GovExec.com.
We think these reports might interest you:

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • The Big Data Campaign Trail

    With everyone so focused on security following recent breaches at federal, state and local government and education institutions, there has been little emphasis on the need for better operations. This report breaks down some of the biggest operational challenges in IT management and provides insight into how agencies and leaders can successfully solve some of the biggest lingering government IT issues.

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download
  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

    Download

When you download a report, your information may be shared with the underwriters of that document.