Breach at U.S. government contractor affected at least 25,000 workers!

A cyber attack at a company that performs background checks for the U.S. Department of Homeland Security compromised data of at least 25,000 government workers, and that number could rise, an agency official said on Friday.

The official told Reuters that DHS plans to notify approximately 25,000 employees that they may be "impacted" by the computer breach at Falls Church, Virginia-based US Investigations Services (USIS) over the coming days.

"More could be notified in coming weeks as we learn more about the breach," said the official, who asked not to be identified by name.

The company disclosed the attack earlier this month, but did not say how many records had been compromised. It did say the intrusion has "all the markings of a state-sponsored attack."

Security experts say the attack was particularly disturbing because files on background checks typically contain highly personal data that foreign intelligence agencies could attempt to exploit to intimidate government workers with access to classified information.

"They would be collecting this data to identify individuals who might be vulnerable to extortion and recruitment," said Dmitri Alperovitch, chief technology officer with cybersecurity firm CrowdStrike, which sells intelligence on state-sponsored cyber attacks.

The Department of Homeland Security has suspended all work with USIS since the breach was disclosed as the government conducts a multi-agency investigation to identify the scope of the attack. The FBI has also launched an investigation.

DHS has asked employees to monitor financial information and be suspicious of unusual unsolicited calls, visits and emails from individuals asking about employees or other work-related issues, according to the official.

Individuals who received any suspicious "targeted" communications will be provided credit monitoring services, the official said.

But Alperovitch said credit monitoring would not be of much help because state-sponsored attackers would not be interested in identity theft. Instead, the government should be providing training in areas such as identifying individuals who might try to compromise them through extortion, he said.

USIS says it is the biggest commercial provider of background investigations to the federal government, with over 5,700 employees, and provides services in all U.S. states and territories, as well as abroad.

Officials with USIS, which is a division of privately held Altegrity Inc, could not immediately be reached for comment.

Source: Reuters