Houston, we’ve had a problem: NASA fears internal server hacked, staff personal info swiped by miscreants

Another leak, this time it’s personal. Plus: Trump launches Space Force, er, Command

No spacecraft were harmed in this incident

A server containing personal information, including social security numbers, of current and former NASA workers may have been hacked, and its data stolen, it emerged today.

According to an internal memo circulated among staff on Tuesday, in mid-October the US space agency investigated whether or not two of its machines holding employee records had been compromised, and discovered one of them may have been infiltrated by miscreants.

It was further feared that this sensitive personal data had been siphoned from the hijacked server. The agency’s top brass stressed no space missions were affected, and identity theft protection will be offered to all affected workers, past and present. The boffinry nerve-center’s IT staff have since secured the servers, and are combing through other systems to ensure they are fully defended, we’re told.

Anyone who joined, left, or transferred within the agency from July 2006 to October 2018 may have had their personal records swiped, according to NASA bosses. Right now, the agency employs roughly 17,300 people.

“Upon discovery of the incidents, NASA cybersecurity personnel took immediate action to secure the servers and the data contained within,” the memo, issued by assistant administrator Bob Gibbs, stated.

“NASA and its federal cybersecurity partners are continuing to examine the servers to determine the scope of the potential data exfiltration and identify potentially affected individuals. This process will take time. The ongoing investigation is a top agency priority, with senior leadership actively involved. NASA does not believe that any agency missions were jeopardized by the cyber incidents.”

In a statement to The Register today, a spokesperson for NASA told us:

We’ve asked NASA while it took nearly two months to inform staff, despite it being a top priority, and what exactly may have been exfiltrated. “We cannot go into specifics about the data,” a spokesperson told us, adding: “However, 2 CFR 200.79 defines PII as “…information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.” ®

Additional reporting by Richard Speed.