"Several" US federal government agencies have been hit in a global cyberattack that exploits a vulnerability in widely used software.
The US Cybersecurity and Infrastructure Security Agency "is providing support to several federal agencies that have experienced intrusions" affecting vulnerable software exploited by the hackers, Eric Goldstein, the agency's executive assistant director for cybersecurity, said in a statement on Thursday to CNN. "We are working urgently to understand impacts and ensure timely remediation."
It was not immediately clear if the hackers responsible for breaching the federal agencies were a Russian-speaking ransomware group that has claimed credit for numerous other victims in the hacking campaign.
A CISA spokesperson had no comment when CNN asked who carried out the hack of federal agencies and how many have been affected.
But the news adds to a growing tally of victims of a sprawling hacking campaign that began two weeks ago and has hit major US universities and state governments. The hacking spree mounts pressure on federal officials who have pledged to put a dent in the scourge of ransomware attacks that have hobbled schools, hospitals and local governments across the US.
Johns Hopkins University in Baltimore and the university's renowned health system said in a statement this week that "sensitive personal and financial information," including health billing records may have been stolen in the hack.
Meanwhile, Georgia's state-wide university system -- which spans the 40,000-student University of Georgia along with over a dozen other state colleges and universities -- confirmed it was investigating the "scope and severity" of the hack.
A Russian-speaking hacking group known as CLOP last week claimed credit for the some of the hacks, which have also affected employees of the BBC, British Airways, oil giant Shell, and state governments in Minnesota and Illinois, among others.
The Russian hackers were the first to exploit the vulnerability, but experts say other groups may now have access to software code needed to conduct attacks.
The ransomware group had given victims until Wednesday to contact them about paying a ransom, after which they began listing more alleged victims from the hack on their extortion site on the dark web. As of Thursday morning, the dark website did not list any US federal agencies.
The episode shows the widespread impact that a single software flaw can have if exploited by skilled criminals.
The hackers -- a well-known group whose favored malware emerged in 2019 -- in late May began exploiting a new flaw in a widely used file-transfer software known as MOVEit, appearing to target as many exposed organizations as they could. The opportunistic nature of the hack left a broad swath of organizations vulnerable to extortion.
Progress, the US firm that owns the MOVEit software, has also urged victims to update their software packages and has issued security advice.
