U.S. undercover investigators among those exposed in data breach

BOSTON/WASHINGTON Fri Aug 22, 2014 6:35pm EDT

A man types on a computer keyboard in Warsaw in this February 28, 2013 illustration file picture. REUTERS/Kacper Pempel/Files

A man types on a computer keyboard in Warsaw in this February 28, 2013 illustration file picture.

Credit: Reuters/Kacper Pempel/Files

Related Topics

BOSTON/WASHINGTON (Reuters) - A cyber attack at a firm that performs background checks for U.S. government employees compromised data of at least 25,000 workers, including some undercover investigators, and that number could rise, agency officials said on Friday.

The breach at Falls Church, Virginia-based US Investigations Services (USIS) exposed highly personal information of workers at the Department of Homeland Security's headquarters as well as its U.S. Immigration and Customs Enforcement and U.S. Customs and Border Protection units, two officials familiar with the investigation into the breach told Reuters.

Some employees have already received letters warning them about the breach that say compromised information includes Social Security numbers, education and criminal history, birth dates along with information about spouses, other relatives and friends including their names and addresses.

"Records including this data were exposed to unauthorized users during the cybersecurity intrusion," according to a notification letter obtained by Reuters. "We do not yet know whether the data was actually taken."

One DHS official told Reuters the agency has identified some 25,000 employees whose information it believes were exposed in the breach.

"More could be notified in coming weeks as we learn more about the breach," said the official, who asked not to be identified by name.

The company disclosed the attack earlier this month, but did not say how many records had been compromised or which agencies were affected. It did say the intrusion has "all the markings of a state-sponsored attack."

While the number of employees affected is relatively small compared to breaches at retailers such as Target Corp, which have affected tens of millions of customers, security experts say the attack on USIS is nonetheless quite serious.

Files on background checks contain highly sensitive data that foreign intelligence agencies could attempt to exploit to intimidate government workers with access to classified information.

"They would be collecting this data to identify individuals who might be vulnerable to extortion and recruitment," said Dmitri Alperovitch, chief technology officer with cybersecurity firm CrowdStrike, which sells intelligence on state-sponsored cyber attacks.

The Department of Homeland Security has suspended all work with USIS since the breach was disclosed and the FBI launched an investigation.

USIS says it is the biggest commercial provider of background investigations to the federal government, with over 5,700 employees, and provides services in all U.S. states and territories, as well as abroad.

Officials with USIS, which is a division of Altegrity Inc, could not immediately be reached for comment.

A spokeswoman for Altegrity, which is majority owned by Providence Equity Partners, declined to comment.

(Reporting by Jim Finkle in Boston; Additional reporting by Mark Hosenball; Editing by Meredith Mazzilli, Leslie Adler and Tom Brown)

FILED UNDER:
We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
Comments (6)
Harry12345 wrote:
No surprises here. USIS makes the news monthly, never good. They need to pack it up & get out of investigation business.

Aug 22, 2014 3:50pm EDT  --  Report as abuse
JoeSchmoe123 wrote:
Notice everyone has been hacked lately? It’s because the computers all speak the same language, and they’re connected using lines of communication that others can get to.

Maybe our Internet is our modern Tower of Babel? Humanity finds a way for everyone to participate and the supposed “good guys” would rather make an extra couple dollars than actively protect their systems that use computation, and the “bad guys” simply hack-in.

Our phone systems are just as bad – we and probably you, get annoying phone calls from automated systems – yet AT&T (for one example) doesn’t block this illegal network traffic within their own networks. Funny thing? When I disconnect my computer’s DSL router, the phone rings with one of those calls. Strange?

Aug 22, 2014 3:53pm EDT  --  Report as abuse
State sponsored. Anyone care to wager a guess at who?

Aug 22, 2014 4:03pm EDT  --  Report as abuse
This discussion is now closed. We welcome comments on our articles for a limited period after their publication.