This week’s one for the books! Some kinds of online aggression are “noisy” and some are “quiet.” The US federal government was sent reeling by a massive cybersecurity incident that sounds like it came out of a spy novel. This tale of a US government hack featuring third party security risk, nation-state hacking, phishing, and cybercrime should serve as a caution for every organization.

The unraveling of this cybersecurity disaster began with cybersecurity penetration testing and development heavyweight FireEye announcing that it had been breached by suspected Russia-backed nation-state hackers. “Sunburst” has also hit the U.S. NNSA, but the extent of the damage is impossible to estimate yet.

The U.S. National Nuclear Security Administration confirmed that hackers have accessed its networks and engaged in cyber-espionage. This has happened in the context of the “Sunburst” attacks that have affected a large number of federal agencies and several organizations in the country.

The next round of revelations would turn those rumbles into an earthquake. Multiple US federal agencies began discovering that they too had experienced security breaches that could be traced to Russia-backed hackers. FireEye revealed on Tuesday that its own systems were pierced by what it called “a nation with top-tier offensive capabilities.” The company said hackers used “novel techniques” to make off with its own tool kit, which could be useful in mounting new attacks around the world.

Then SolarWinds announced that it too had been breached by suspected Russian nation-state hackers. Bad actors obtained legitimate credentials allowing them to access systems undetected, likely through a variety of phishing. It seems like new data breaches are hitting the news constantly. With each successful breach, bad actors don’t just gain valuable company data. They also gain PII and lists of passwords. Data is like currency on the Dark Web, and everyone’s wheeling and dealing. New caches of data arrive daily, bursting with information that can give criminals the key to your front door.

Netenrich’s CSO Brandon Hoffman said:

This is really just the beginning. As soon as we think it can’t get any worse, more evidence will be found. The government needs to really step up and prepare for the fallout of all this data loss. Claiming we don’t know will not satisfy the public about the state of national security. There needs to be some level of transparency about what was taken and how we plan to respond based on all the potential ways this data can be used.

We’ll never know the whole story of what happened and how due to the sensitive nature of much of the material and the parties involved, but even a surface examination teaches us a few important lessons about cybersecurity and threats in today’s tumultuous landscape, and show us a few ways that we all can protect ourselves.

Want more tips? Follow us to learn more about IT security solutions and monitoring. We can help you design a solution to meet your need. Here at ManagedTEK we strive to provide top security solutions. If you have an immediate IT need, you can always reach us at 707.205.3727. ManagedTEK’s goal is to create a plan specifically focused on each business that we serve. Technology made simple.