Tag Archives: cyber breach

U.S. SEC seeks information from SolarWinds clients in cyber breach probe

By Katanga Johnson

WASHINGTON (Reuters) – The U.S. Securities and Exchange Commission (SEC) has opened a probe into last year’s SolarWinds cyber breach over whether some companies failed to disclose that they had been affected by the unprecedented hack, an agency official said on Monday.

The SEC sent investigative letters late last week to a small number of public issuers and investment firms seeking voluntary information on whether they had been victims of the hacker and failed to disclose it.

The agency said it was also seeking information on whether public companies that had been a victim had experienced a lapse of internal controls, and related information on insider trading. U.S. securities law requires companies to disclose material information that could affect their share prices.

“We think that the information we’re asking for will help us assess the impact of the breach, and it may also help us identify trading or other securities law violations,” said the official, who spoke under the condition of anonymity for discussing ongoing, confidential agency investigations.

In December, U.S. regulators found that a breach by a foreign actor of SolarWinds’s software gave hackers access to data of thousands of companies and government offices that used its products.

The United States and Britain have blamed Russia’s Foreign Intelligence Service (SVR), successor to the foreign spying operations of the KGB, for the hack, which compromised nine U.S. federal agencies and hundreds of U.S. private sector companies.

A spokesperson for SolarWinds did not respond immediately to request for comment.

(Reporting by Katanga Johnson; Editing by Steve Orlofsky)

Russian hackers accused of post-election attacks on U.S. think tanks

padlock graphic

By Jim Finkle and Dustin Volz

(Reuters) – A Russian hacking group began attacking U.S.-based policy think tanks within hours of Donald Trump’s presidential election victory, according to cyber experts who suspect Moscow is seeking information on the incoming administration.

Three cyber security firms told Reuters that are tracking a spear-phishing campaign by a Russian-government linked group known as Cozy Bear, which is widely suspected of hacking the Democratic Party ahead of the election.

“Probably now they are trying to rush to gain access to certain targets where they can get a better understanding on what is going on in Washington after the election and during the transition period,” said Jaime Blasco, chief scientist with cyber security firm AlienVault.

Targets included the Council for Foreign Relations, said Adam Segal, a security expert with the think tank. His colleagues include former U.S. Senator John D. Rockefeller IV and former Reagan administration State Department official Elliott Abrams.

Representatives with the Russian Embassy in Washington could not be reached for comment. Moscow has strongly denied that it was behind the hacks.

Spear-phishing campaigns use malware-tainted emails to infect computers of carefully selected staff at target organizations. They typically appear to be from people whom the victims know and on subjects of interest to them.

Some of the emails appeared to be from Harvard University under the subject line, “Why American Elections are flawed,” according to Washington-based cyber security firm Volexity.

The attacks began as the Obama administration was weighing if and how it might respond in its final two months to a series of high-profile hacks on Democratic Party organizations that U.S. intelligence officials have publicly blamed on Moscow.

A former senior Obama administration official said on Thursday that the White House had decided to take action against Russia after the election but no decision had been made on exactly how to respond.

Options included U.S. prosecutors indicting Russians believed to be behind the attacks, applying new economic sanctions against Moscow and the United States launching a retaliatory cyber attack against Russia, said the former official who asked not to be named.

White House officials feared that retaliating before the election could have led Russia to launch a major cyber attack on the United States that would have disrupted the banking system, power grid or internet service. But they said administration officials had decided that the United States needed to show after the election that it would respond to state-sponsored cyber attacks, said the former official.

Trump has said he is not convinced Russia was behind the attacks. He has yet to fill key national security posts, which makes it difficult to assess how his administration might handle the issue.

Harvard’s chief information security officer, Christian Hamer, warned staff about the attacks on Thursday afternoon, saying that federal law enforcement was investigating.

He said some of the emails used in the campaign appeared as if they were sent from members of Harvard’s Faculty of Arts and Sciences, using the school’s branding.

An FBI representative declined comment.

(Reporting by Jim Finkle in Boston and Dustin Volz in Washington. Additional reporting by David Rohde in New York and Steve Holland in Washington.; Editing by Cynthia Osterman)

Yahoo says hackers stole data from 500 million accounts

A Yahoo logo is seen on top of the building where they have offices in New York

By Dustin Volz

(Reuters) – Yahoo Inc said on Thursday that at least 500 million of its accounts were hacked in 2014 by what it believed was a state-sponsored actor, a theft that appeared to be the world’s biggest known cyber breach by far.

Cyber thieves may have stolen names, email addresses, telephone numbers, dates of birth and encrypted passwords, the company said. But unprotected passwords, payment card data and bank account information did not appear to have been compromised, signaling that some of the most valuable user data was not taken.

The attack on Yahoo was unprecedented in size, more than triple other large attacks on sites such as eBay Inc, and it comes to light at a difficult time for Yahoo.

Chief Executive Officer Marissa Mayer is under pressure to shore up the flagging fortunes of the site founded in 1994, and the company in July agreed to a $4.83 billion cash sale of its internet business to Verizon Communications Inc.

“This is the biggest data breach ever,” said well-known cryptologist Bruce Schneier, adding that the impact on Yahoo and its users remained unclear because many questions remain, including the identity of the state-sponsored hackers behind it.

On its website on Thursday, Yahoo encouraged users to change their passwords but did not require it.

Although the attack happened in 2014, Yahoo only discovered the incursion after August reports of a separate breach. While that report turned out to be false, Yahoo’s investigation turned up the 2014 theft, according to a person familiar with the matter.

Analyst Robert Peck of SunTrust Robinson Humphrey said the breach probably was not enough to prompt Verizon to abandon its deal with Yahoo, but it could call for a price decrease of $100 million to $200 million, depending on how many users leave Yahoo.

Steven Caponi, an attorney at K&L Gates with a practice including merger litigation, said that Yahoo’s breach could fall under the “material adverse change” clause common in mergers allowing a buyer to walk away if its target’s value deteriorates.

“That would give Verizon the opportunity to renegotiate the terms or potentially walk away from the transaction if it is a material change. Whether it is a material change will depend in large part on what kind of information was compromised,” Caponi said.

Still, it is rare for mergers to fall apart over material changes. Verizon said in a statement it was made aware of the breach within the last two days and had limited information about the matter.

“We will evaluate as the investigation continues through the lens of overall Verizon interests,” the company said.

Shares of Yahoo stock closed a penny higher at $44.15, while shares of Verizon, were up about 1 percent.

RISING ATTACKS

The Yahoo breach follows a rising number of other large-scale data attacks and could make it a watershed event that prompts government and businesses to put more effort into bolstering defenses, said Dan Kaminsky, a well-known internet security expert.

Retailers and health insurers have been especially hard hit after high-profile breaches at Home Depot Inc, Target Corp, Anthem Inc and Premera Blue Cross.

“Five hundred of the Fortune 500 have been hacked,” he said. “If anything has changed, it’s that these attacks are getting publicly disclosed.”

Three U.S. intelligence officials, who declined to be identified by name, said they believed the attack was state-sponsored because of its resemblance to previous hacks traced to Russian intelligence agencies or hackers acting at their direction.

Yahoo said it was working with law enforcement on the matter, and the FBI said it was investigating.

“The investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network,” the company said.

While the breach comprised mostly low-value information, it did include security questions and answers created by users themselves. That data could make users vulnerable if they use the same answers on other sites.

A former Yahoo employee said the Q&A were deliberately left unencrypted, which allowed Yahoo to catch fake accounts more easily because fake accounts tended to reuse questions and answers.

News of the massive breach at one of the nation’s largest email providers may fan concern that U.S. companies and government agencies are not doing enough to improve cyber security.

Democratic Senator Mark Warner said in a statement he was “most troubled by news that this breach occurred in 2014, and yet the public is only learning details of it today.”

Technology website Recode first reported Tuesday that Yahoo planned to disclose details about a data breach affecting hundreds of millions of users.

(Reporting by Aishwarya Venugopal in Bengaluru and Dustin Volz in Washington; additional reporting by Jim Finkle in Boston, Lauren Hirsch in New York, and Joseph Menn and Deborah Todd in San Francisco, writing by Alwyn Scott; editing by Peter Henderson and Cynthia Osterman)