Secret Service Probing Breach At Federal IT Contractor

Credentials and email messages pilfered in a breach of a federal government contractor that could be used to access the contractor’s systems and those of its customers – including the U.S. Department of Transportation, the National Institutes of Health (NIH), and the U.S. Citizenship and Immigration Services (USCIS) – were auctioned off in a Russian cybercrime site in August, prompting an investigation by the U.S. Secret Service.  

The information is “all old stuff in our own internal test environment, and it is no longer valid,” a KrebsOnSecurity report cited Miracle Systems LLC CEO Sandesh Sharda as saying. The company claims to be a prime contractor to more than 20 federal agencies.

The report noted that multiple systems of one company, Hold Security, had been compromised three times by Emotet malware from November 2018 to July 2019.

The FISMA Act of 2002 as well as FAR 52.204-21 in 2017, respectively, require agencies to manage their security and privacy controls and make sure their contractors meet 15 security controls. “But how can a government agency efficiently test its suppliers’ information security?” said Dov Goldman, director of risk and compliance at Panorays. “What’s more, how can they manage many more subcontractors’ InfoSec?”

While “private companies with mature third-party information security programs are increasingly aware of the need to manage security deep in their supply chain,” smaller, more innovative providers often “have less sophisticated infosec programs,” Goldman said, noting that the vast sprawl of federal government contracting. “Because there are so many smaller players as you dive deeper into the supply chain, it becomes more and more important to implement highly automated approaches to assess suppliers’ InfoSec controls and the integrity of their attack surface.”

The breach at Miracle Systems “seems to have caused no harm,” but should still “serve as a wakeup call for U.S. federal government agencies to find the most innovative, effective and automated solutions for assessing, managing and monitoring supply chain security.”