U.S. Energy Dept gets two ransom notices as MOVEit hack claims more
victims
Send a link to a friend
[June 17, 2023]
By Timothy Gardner and Raphael Satter
WASHINGTON (Reuters) -The U.S. Department of Energy got ransom requests
from the Russia-linked extortion group Cl0p at both its nuclear waste
facility and scientific education facility that were recently hit in a
global hacking campaign, a spokesperson said on Friday.
The DOE contractor Oak Ridge Associated Universities and the Waste
Isolation Pilot Plant, the New Mexico-based facility for disposal of
defense-related radioactive nuclear waste, were hit in the attack, which
was first reported on Thursday.
Data was "compromised" at the two DOE entities after hackers breached
their systems through a security flaw in the file transfer tool MOVEit
Transfer. The software is widely-used by organisations around the world
to share sensitive data.
![](http://archives.lincolndailynews.com/2023/Jun/17/images/ads/current/nutrienag_sda_HEROES_2023.png)
From U.S. government departments to the UK's telecom regulator and
energy giant Shell, a range of victims have emerged since Burlington,
Massachusetts-based Progress Software found the security flaw in its
MOVEit Transfer product last month.
The wide-ranging impact of it shows how even the most security-minded
federal agencies are struggling to defend against ransomware attacks.
Ransomware gangs typically scour for such widely-used tools.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said
Thursday that several federal agencies had been hit by the MOVEit
breach. It did not say which ones, but added that there had not been
much impact to the federal civilian executive branch.
[to top of second column]
|
![](http://archives.lincolndailynews.com/2019/Sep/05/images/ads/current/stclara_lda_SPONSOR_090519.png)
Analysts say more victims are likely to emerge in the coming weeks.
The ransom requests to DOE came in emails to each facility, said the
spokesperson, without revealing how much money was demanded. "They
came in individually, not as kind of a blind carbon copy," the
spokesperson said. "The two entities that received them did not
engage," with Cl0p and there was no indication the ransom requests
were withdrawn, he said.
The DOE, which manages U.S. nuclear weapons and nuclear waste sites
related to the military, notified Congress of the breach and is
participating in investigations with law enforcement and the CISA.
Cl0p did not respond to requests for comment, but in a post on its
website, it said, “WE DON'T HAVE ANY GOVERNMENT DATA” and suggested
that should the hackers inadvertently have picked up such data in
their mass theft “WE STILL DO THE POLITE THING AND DELETE ALL.”
Recorded Future analyst Allan Liska said Cl0p was likely making a
big deal out of how they purportedly deleted government data in an
attempt to protect themselves from retaliation from Washington and
other governments.
(Reporting by Timothy Gardner and Raphael Satter; Additional
reporting by Zeba Siddiqui; Editing by Leslie Adler and Daniel
Wallis)
[© 2023 Thomson Reuters. All rights
reserved.]This material may not be published,
broadcast, rewritten or redistributed.
Thompson Reuters is solely responsible for this content.
![](http://archives.lincolndailynews.com/2023/Jun/17/images/ads/current/charrons_bch_2022.png) |