U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that Russian government-backed hackers stole emails from several U.S. federal agencies as a result of an ongoing cyberattack at Microsoft.
In a statement published Thursday, the U.S. cyber agency said the cyberattack, which Microsoft initially disclosed in January, allowed the hackers to steal federal government emails “through a successful compromise of Microsoft corporate email accounts.”
The hackers, which Microsoft calls “Midnight Blizzard,” also known as APT29, are widely believed to work for Russia’s Foreign Intelligence Service, or SVR.
If the US government is stupid enough to store data with Microsoft, they should not complain. OK, maybe they should, to Microsoft.
It’s such an embarrassment. Our government has access to incredible technological resources, yet they still use unencrypted email.
If only end-to-end encryption was simple, available, and part of most communications somehow. In some magical fairy land where that sort of thing is possible.
Not in the richest nation on earth though. No, we crammed everything into the cheapest bucket we could pork barrel away and will now blame someone else while accepting huge campaign contributions.
Epic failure even for a company known for decades-long security flaws and consistently poor software quality.
I shouldn’t be shocked, but I am.
Apparently Microsoft disclosed the attack in January and it’s still ongoing three months later.
The federal government used outlook?
Used? Still uses. Outlook is how all the US military handles email, by extension I’d assume that’s how all .gov handles unclassified email.
Not all military. A significant number of active duty Army are using Google. There are other pockets of divergence out there.
Really? Why aren’t they using mail.mil? Does Google have CAC login?
Don’t know, you should ask secretaryofdefense@gmail.com
Jokes aside, any company providing services to the government is going to have met the original RFP requirements.
Also, they’ll probably have separate infrastructure for military contracts, which I assume was also a requirement of any bid - but that’s just a guess. Someone else can correct me if I’m wrong.
It’s called FEDRAMP. Yes, for DoD separate infrastructure is required, but that is not true of all Government agencies. E.g., would BLM really need separate secure infrastructure from the commercial sector? Probably not worth the expense and effort.
Yes. Despite the obvious security flaws and other bullshit associated with using Micro$oft, they’ve leveraged their historical monopoly position to manage email for large swaths of the federal government.
It’s fucking nightmarish and insane to boot, and here we are.
Oh and also russia stole a bunch of emails from us becase of that.
So. Thanks for running the government like a shitty business, feds! Yeah you sure saved a boatload on datacenter expenses didntya.
And, I assume, were sent straight to the Trump campaign upon finding anything useful.
OMG did you hear [random governmental employee] likes [random thing]?? Clearly a sophisticated code for pedophilia!!!
Everybody grab your assault weapons and meet up at the pizza place!
