Records held by the NFC include federal employee social security numbers, phone numbers and personal email addresses as well as banking information. The NFC is responsible for handling the payroll of multiple government agencies, including several involved in national security, such as the FBI, State Department, Homeland Security Department and Treasury Department, the former officials said. But the potential impact could be “massive,” former U.S. Reuters could not determine what information the attackers were able to steal from the National Finance Center (NFC) or how deep they burrowed into its systems. The connection between the second set of attacks on SolarWinds customers and suspected Chinese hackers was only discovered in recent weeks, according to security analysts investigating alongside the U.S.
#Solarwinds customers software#
While the alleged Russian hackers penetrated deep into SolarWinds network and hid a “back door” in Orion software updates which were then sent to customers, the suspected Chinese group exploited a separate bug in Orion’s code to help spread across networks they had already compromised, the sources said. government, they were separate and distinctly different operations, according to four people who have investigated the attacks and outside experts who reviewed the code used by both sets of hackers. SolarWinds did not say how the hackers first got in, except to say it was “in a way that was unrelated to SolarWinds.”Īlthough the two espionage efforts overlap and both targeted the U.S. In the case of the sole client it knew about, SolarWinds said the hackers only abused its software once inside the client’s network. banner hangs at the New York Stock Exchange (NYSE) on the IPO day of the company in New York, U.S., October 19, 2018. The sources, who spoke on condition of anonymity to discuss ongoing investigations, said the attackers used computer infrastructure and hacking tools previously deployed by state-backed Chinese cyberspies.įILE PHOTO: SolarWinds Corp. Reuters was not able to establish how many organizations were compromised by the suspected Chinese operation. government breach have not been previously reported. Security researchers have previously said a second group of hackers was abusing SolarWinds’ software at the same time as the alleged Russian hack, but the suspected connection to China and ensuing U.S. The software flaw exploited by the suspected Chinese group is separate from the one the United States has accused Russian government operatives of using to compromise up to 18,000 SolarWinds customers, including sensitive federal agencies, by hijacking the company’s Orion network monitoring software. Department of Agriculture, was among the affected organizations, raising fears that data on thousands of government employees may have been compromised. While the letters are focused on the SolarWinds breach, the SEC may develop future policies on the impact of cybersecurity issues on the markets and on investors, the people said.Two people briefed on the case said FBI investigators recently found that the National Finance Center, a federal payroll agency inside the U.S. If the issuers and investment firms respond to the letters by disclosing details about the breaches, they would not be subject to enforcement actions related to historical failures, including internal accounting control failures, the people said. The United States and Britain have blamed Russia's Foreign Intelligence Service (SVR), successor to the foreign spying operations of the KGB, for the hack, which compromised nine US federal agencies and hundreds of US private sector companies. News of the hack sent SolarWinds' share price tumbling, while cybersecurity stocks rallied. In December, US regulators found that a breach by a foreign actor of SolarWinds' software gave hackers access to data of thousands of companies and government offices that used its products. US securities law requires companies to disclose material information that could affect their share prices, including cyber breaches, although cybersecurity disclosure failures are still relatively new enforcement territory for the SEC. The company was also "collaborating with government agencies in a transparent way," the statement said.