Hackers breached computer systems for US federal agencies including the Treasury and Commerce departments, US Government officials have confirmed.
The FBI and the Department of Homeland Security’s cybersecurity arm are investigating.
Reuters sources familiar with the investigation said Russia was believed to be behind the attack.
There is concern within the US intelligence community that the hackers who targeted Treasury and the Commerce Department’s National Telecommunications and Information Administration (NTIA) used a similar tool to break into other Government agencies, according to four people briefed on the matter.
Two said the breaches were connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major US cybersecurity company with government and commercial contracts.
The hack was so serious it led to a National Security Council meeting at the White House on Saturday local time, said one of the people familiar with the matter.
“The United States Government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said National Security Council spokesman John Ullyot.
The Government’s Cybersecurity and Infrastructure Security Agency (CISA) said it had been working with other agencies “regarding recently discovered activity on government networks”.
“CISA is providing technical assistance to affected entities as they work to identify and mitigate any potential compromises,” it said in a statement.
President Donald Trump last month fired the CISA director Chris Krebs, who had vouched for the integrity of the presidential election and disputed the President’s claims of widespread electoral fraud.
The Commerce Department confirmed there was a breach at one of its agencies in a statement.
“We have asked the Cybersecurity and Infrastructure Security Agency and the FBI to investigate, and we cannot comment further at this time,” it said.
‘A huge cyber espionage campaign’
The breach presents a major challenge to the incoming administration of president-elect Joe Biden as officials investigate what information was stolen and try to ascertain what it will be used for.
It is not uncommon for large scale cyber investigations to take months or years to complete.
“This is a much bigger story than one single agency,” said one of the people familiar with the matter.
“This is a huge cyber espionage campaign targeting the US Government and its interests.”
Hackers broke into the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said.
A Microsoft spokesperson did not immediately respond to a request for comment.
Neither did a spokesman for the Treasury Department.
The hackers were “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not authorised to speak to the press.
“This is a nation-state,” said a different person briefed on the matter.
The full scope of the breach is unclear. The investigation is still its early stages and involves a range of federal agencies, including the FBI, according to three of the people familiar with the matter.
The FBI and US National Security Agency did not immediately respond to a request for comment.
There were indications the email compromise at NTIA dates back to earlier this year, although it was only recently discovered, according to a senior US official.
Cybersecurity firm compromised
Last Tuesday, prominent US cybersecurity firm FireEye said that foreign government hackers with “world-class capabilities” broke into its network and stole offensive tools it uses to probe the defences of its customers.
Those customers included federal, state and local governments and top global corporations.
The hackers “primarily sought information related to certain government customers”, FireEye chief executive Kevin Mandia said in a statement, without naming them.
He said there was no indication they got customer information from the company’s consulting or breach-response businesses or threat-intelligence data it collects.
FireEye is a major cybersecurity player — it responded to the Sony and Equifax data breaches and helped Saudi Arabia thwart an oil industry cyberattack — and has played a key role in identifying Russia as the protagonist in numerous aggressions in the burgeoning netherworld of global digital conflict.
Neither Mr Mandia nor a FireEye spokesperson said when the company detected the hack or who might be responsible.