US Marshals Service breached by ransomware attack

Despite a drop in ransomware attacks since last year, the US Marshals Service revealed on Monday that it suffered a “major” computer network breach on February 17 that included a component of ransomware.

Many recent cybersecurity reports suggest that ransomware is becoming less profitable for cybercriminals as more and more victims refuse to pay their attackers. But an ongoing wave of hacking attacks continues to target businesses and government organizations.

US Marshals Service spokesperson Drew Wade said in comments to the media on Monday, February 27 that the agency received a ransomware request and discovered a data exfiltration event that affected the autonomous computing system of the agency.

According to Wade, the attack affected information involving sensitive law enforcement details, returns from legal proceedings and administrative information. However, the ransomware did not impact the witness security program because the service disconnected computers from the network.

The attack also obtained personally identifiable information regarding the subjects of USMS investigations, third parties, and certain USMS employees. The breach affected records about the targets of ongoing investigations, employee personal data and internal processes.

“The data exfiltration attack on the US Marshals Service is a distressing reminder of the far-reaching and devastating effects that cyberattacks can have on our most critical institutions,” said Dimitri Nemirovsky, co-founder and director of the operation of decentralized encryption key management company Atakama, says TechNewsWorld.

“The theft of confidential US Marshal data can jeopardize ongoing investigations, endanger the lives of law enforcement, and undermine public confidence in our justice system,” he added.

Engage damage control

The Marshals Service, a federal agency responsible for tracking down and capturing fugitives wanted by law enforcement, is also part of the US Department of Justice. In addition to its work with fugitives, the service provides security for federal courthouses across the country, among other duties.

Government officials have yet to identify potential culprits in the cyberattack. But Marshals Service employees reportedly created a workaround to maintain its internal operations and search for fugitives.

The announcement of the US Marshals breach comes a week after the FBI said it “contained” a security incident on its network. It is the latest successful intrusion into government records amid ongoing hacking attempts at various levels of government and public institutions over the past few months.

For example, the DOJ infiltrated and disrupted the Hive ransomware group in late January. According to reports, the group had targeted more than 1,500 victims in more than 80 countries, extorting hundreds of millions of dollars in ransoms.

“We must remain vigilant in our efforts to defend against these attacks and protect sensitive information from being exposed,” Nemirovsky offered. “Implementing proactive and granular data protection measures to protect all confidential, sensitive and personally identifiable information should not be an afterthought.”

Unclear goals

US government officials have remained silent on the details of the dynamics of the cyber breach. Other than confirming that a ransomware component was involved, insiders did not say whether the service had received threats of leaking hacked information or demanded payment. It’s also unclear at this point whether the attack involved encrypting files on the server.

“In today’s digital age, protecting sensitive files at a granular level is not just an option; it is a necessity,” observed Nemirovsky.

Unofficially, some cybersecurity workers have suggested that ransomware threats are sometimes included as a ruse to mask other attack goals. Among the list of unanswered questions is how the attackers managed to bypass network security measures.

Further investigation needed

While we don’t yet know the exact information these threat actors may have exfiltrated from the US Marshals Service, the ramifications could be significant, warned Darren Guccione, CEO and co-founder of Keeper Security.

“Based on the information available to us, the stolen information may compromise ongoing investigations, including witnesses and informants, put USMS employees at risk, and disrupt emergency operations during the recovery of the USMS” , Guccione told TechNewsWorld.

Another significant ramification is the impact on public trust in the US Marshals Service, he added.

A case of lessons maybe not learned

This seemingly severe enough breach demonstrates yet again that even the most vigilant entities are not immune to ransomware and other sophisticated attacks, according to Theon Technology Advisory Board Member Bryan Cunningham.

“As a victim of the Chinese hack of US OPM security clearance files, it is infuriating that our government – or at least the USMS – has apparently not learned from its past mistakes. It seems that these data hasn’t even been encrypted,” he told TechNewsWorld.

Cunningham is certain the story will get worse as the incident is investigated. Almost all data exfiltration/ransomware attacks are the result of poor training and security awareness, which is particularly disappointing in a US law enforcement agency, he suggested.

“Having said that, it’s not that surprising, because humans are fallible and attacks are getting more and more sophisticated. This reinforces the imperative to develop quantum-resistant encryption and much better security awareness training and enforcement. Someone has to be held accountable here,” he advised.