Another federal breach exposes employee records

The Energy Department disclosed to Congress on Friday that it suffered a security breach from a hacker in September that compromised 1,500 personnel records.

The news broke just as a House Energy and Commerce Oversight and Investigations Subcommittee was supposed to start a hearing on how secure Energy Department computers are in light of recently reported data breaches at the Internal Revenue Service and Veterans Affairs Department.

Kentucky Republican Ed Whitfield, chairman of the Subcommittee, said there is no excuse for the department to have its current "F" in cyber-security compliance -- or for waiting eight months to tell the Energy secretary or his committee about the security breach.

"It's unbelievable [that] 1,500 personnel files can be compromised with Social Security numbers," Whitfield said. "The impact that can have on individuals is quite disturbing."

Full Energy and Commerce Committee Chairman Joe Barton, R-Texas, visited the hearing room to express his outrage at the data breach and later called Energy Secretary Samuel Bodman. "If the administration won't do something about this incident, this committee will," he said.

While most of the details of the hacking incident were discussed later in executive session, a government agency that tests the department by breaking into its computer system said the attack was at the National Nuclear Security Administration.

NNSA Administrator Linton Brooks said he learned of the "sophisticated" hacking incident in September. He said he did not know whose job it was to tell Bodman, but he wished he had.

"Mr. Brooks, I'm going to recommend you be removed from office, and I think you would do the country a service if you resigned," Barton said. Brooks said that because the breach was labeled a counterintelligence issue, the two sides of the organization each assumed the other had notified the secretary. Barton called that explanation "hogwash."

Energy Chief Information Officer Thomas Pyke said he was aware of various hacking incidents but only learned of the personnel data involved two days ago.

Pyke said the department faces hundreds of thousands of attacks each day. In the event where the records were exposed, he said the attack penetrated both a firewall and a detection system.

Glenn Podonsky, director of the office of security and safety performance assessment, told lawmakers that in November, his team successfully accessed Energy's unclassified computer system. He said they gained access to financial and personal data, and could have impersonated or monitored department executives.

"We basically had domain control," Podonsky said. He said with security improvements made since then that the office could break in but not gain domain control.

He said his office believes Energy is moving too slowly in making security improvements and noted that part of the problem is because of work done by outside contractors.

Whitfield also wanted to know why the Energy Department has failed to report 50 percent of attacks to its computer systems. Podonsky said he agreed they should be reported to help law enforcers track them.

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
FROM OUR SPONSORS
JOIN THE DISCUSSION
Close [ x ] More from GovExec
 
 

Thank you for subscribing to newsletters from GovExec.com.
We think these reports might interest you:

  • Sponsored by Brocade

    Best of 2016 Federal Forum eBook

    Earlier this summer, Federal and tech industry leaders convened to talk security, machine learning, network modernization, DevOps, and much more at the 2016 Federal Forum. This eBook includes a useful summary highlighting the best content shared at the 2016 Federal Forum to help agencies modernize their network infrastructure.

    Download
  • Sponsored by CDW-G

    GBC Flash Poll Series: Merger & Acquisitions

    Download this GBC Flash Poll to learn more about federal perspectives on the impact of industry consolidation.

    Download
  • Sponsored by One Identity

    One Nation Under Guard: Securing User Identities Across State and Local Government

    In 2016, the government can expect even more sophisticated threats on the horizon, making it all the more imperative that agencies enforce proper identity and access management (IAM) practices. In order to better measure the current state of IAM at the state and local level, Government Business Council (GBC) conducted an in-depth research study of state and local employees.

    Download
  • Sponsored by Aquilent

    The Next Federal Evolution of Cloud

    This GBC report explains the evolution of cloud computing in federal government, and provides an outlook for the future of the cloud in government IT.

    Download
  • Sponsored by Aquilent

    A DevOps Roadmap for the Federal Government

    This GBC Report discusses how DevOps is steadily gaining traction among some of government's leading IT developers and agencies.

    Download
  • Sponsored by LTC Partners, administrators of the Federal Long Term Care Insurance Program

    Approaching the Brink of Federal Retirement

    Approximately 10,000 baby boomers are reaching retirement age per day, and a growing number of federal employees are preparing themselves for the next chapter of their lives. Learn how to tackle the challenges that today's workforce faces in laying the groundwork for a smooth and secure retirement.

    Download
  • Sponsored by Hewlett Packard Enterprise

    Cyber Defense 101: Arming the Next Generation of Government Employees

    Read this issue brief to learn about the sector's most potent challenges in the new cyber landscape and how government organizations are building a robust, threat-aware infrastructure

    Download
  • Sponsored by Aquilent

    GBC Issue Brief: Cultivating Digital Services in the Federal Landscape

    Read this GBC issue brief to learn more about the current state of digital services in the government, and how key players are pushing enhancements towards a user-centric approach.

    Download
  • Sponsored by CDW-G

    Joint Enterprise Licensing Agreements

    Read this eBook to learn how defense agencies can achieve savings and efficiencies with an Enterprise Software Agreement.

    Download
  • Sponsored by Cloudera

    Government Forum Content Library

    Get all the essential resources needed for effective technology strategies in the federal landscape.

    Download

When you download a report, your information may be shared with the underwriters of that document.