Two entities within the US Department of Energy (DOE) have fallen victim to a cyberattack from a widespread vulnerability in the MOVEit file transfer software. The impacted DOE entities include Oak Ridge Associated Universities and the Waste Isolation Pilot Plant near Carlsbad, New Mexico.
While the identity of the perpetrators behind the breach remains unclear, the attack has been attributed to a ransomware group known as Cl0P. This group has been exploiting the vulnerability in MOVEit, targeting hundreds of organizations, including universities, banks, and major multinational corporations. Since June 14, Cl0P has added 27 new victim organizations to its leak page.
A spokesperson from the DOE acknowledged that records from two of its entities were compromised in the global cyberattack on MOVEit Transfer, a file-sharing software. In response, immediate measures were taken to prevent further exposure to the vulnerability, and the Cybersecurity and Infrastructure Security Agency (CISA) was promptly notified.
The DOE has informed Congress about the incident and is actively collaborating with law enforcement, CISA, and the affected entities to investigate the breach and mitigate its impacts, according to the spokesperson’s statement.
During a recent media briefing, CISA Director Jen Easterly provided an update, stating that there has been no significant impact on the civilian .gov enterprise thus far. She also mentioned that no federal agency had received extortion demands, and no federal data had been leaked.
Easterly clarified that the attackers specifically targeted information stored on the file transfer application at the time of the intrusion. She characterized the attack as largely opportunistic and not on the scale of a systemic risk like the SolarWinds incident, which threatened national security and the nation’s network.
