U.S. Energy Dept admits to second big data leak this year

Personal information for 14,000 U.S. Department of Energy employees has leaked in a data breach, according to the Wall Street Journal.

“The Department of Energy has confirmed a recent cyber incident that occurred at the end of July and resulted in the unauthorized disclosure of federal employee Personally Identifiable Information (PII). We believe about 14,000 past and current DOE employees PII may have been affected,” the letter states.

ESET security researcher Cameron Camp suggests that the attack may have been deliberate, saying that “effort was involved” and that “the DOE has to stay on its guard,” in a report by SC Magazine.
The Department of Energy admitted to a large-scale breach which involved a leak of personally identifiable information in February this year, according to Computer World. The breach also involved the compromise of 14 servers and 20 workstations.
A Congressional survey of electrical utilities earlier this year found that companies faced up to 10,000 attacks per month. Out of 53 companies surveyed, more than a dozen described attacks on their systems as “daily” or “constant”. One company complained of being under a “constant state of ‘attack’ from malware and entities seeking to gain access to internal systems.”

Cybercriminals have targeted U.S. energy companies with attacks throughout the year, according to the Industrial Control Systems Emergency Response Team (ICS-CERT). A series of attacks were directed against companies operating gas compressor stations in the U.S. in February and March this year.

“While none of the brute force attempts were successful, these incidents highlight the need for constant vigilance on the part of industry,” ICS-CERT said in its newsletter. “ The ability to detect anomalous network activity and network intrusions early in an incident greatly increases the chance of a successful mitigation and resolution.”
The organization says it has responded to more than 100 incidents targeting the energy sector between October 2012 and May 2013.

This April, a spear-phishing attack which targeted an American electrical company was documented in this month’s Monitor report from the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).