Story image

NASA got hacked (again)

20 Dec 2018

The US National Aeronautics and Space Administration (NASA) is one of 2018’s latest data breach casualties, according to media reports.

Website SpaceRef published a NASA internal company memo appearing to coming from Bob Gibbs, NASA’s assistant administrator in the Office of Chief Human Capital Officer.

The memo claims that criminals potentially gained access to NASA servers on October 23, 2018. The compromised servers stored personally identifiable information (PII) belonging to current and former NASA employees. That information included social security numbers and other data.

NASA Civil Service employees who were onboarded, separated from NASA, or transferred between locations from July 2006 to October 2018 may be affected.

The memo was sent to all NASA employees, regardless of whether they were affected by the breach. 

“Once identified, NASA will provide specific follow-up information to those employees, past and present, whose PII was affected, to include offering identity protection services and related resources, as appropriate,” the memo allegedly states.

NASA says that it took immediate action to secure servers and data as soon as it discovered the breach.

“NASA and its Federal cybersecurity partners are continuing to examine the servers to determine the scope of the potential data exfiltration and identify potentially affected individuals. This process will take time. The ongoing investigation is a top agency priority, with senior leadership actively involved. NASA does not believe that any Agency missions were jeopardized by the cyber incidents,” the memo states.

NASA’s leadership team stresses that it takes personal information protection and information security seriously.

“NASA is continuing its efforts to secure all servers, and is reviewing its processes and procedures to ensure that the latest security practices are being followed throughout the agency,” the memo concludes.

While NASA has not yet released any public statements about the breach, the company is no stranger to being a target.

Back in 2016 hacking group AnonSec leaked almost 276GB of confidential NASA data. 

The group even went so far as trying to hack and crash a $222 million NASA drone into the Pacific Ocean. But before the group could crash the drone, NASA spotted the security anomaly and took manual control.

In 2013, an Italian hacker belonging to the ‘Master Italian Hackers Team’ gained access and ‘defaced’ a number of NASA Ames Research Center subdomains, as well as a slew of Italian government websites.  In October 2018, the 25-year-old hacker was sentenced. He was caught after allegedly boasting about the hacks online.

Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
Developing APAC countries most vulnerable to malware - Microsoft
“As cyberattacks continue to increase in frequency and sophistication, understanding prevalent cyberthreats and how to limit their impact has become an imperative.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.