A major security breach has recently hit the US Marshals Service, putting sensitive information at risk, according to senior law enforcement officials. Learn more about the details of the breach, how it happened, the data at risk, and the steps being taken to address it.
The US Marshals Service was hit by a major security breach this month, with hackers breaking into and stealing data from a computer system that contained personal information about investigative targets and agency employees, as confirmed by a spokesman for the service on Monday.
The Justice Department division is responsible for protecting judges, transporting federal prisoners, and operating the federal witness protection program, though the latter’s database was not breached. Nonetheless, hackers accessed information about some fugitives sought by federal authorities. This text shares a look into the incident and will detail how and when it happened.
The US Marshals Service Ransomware Attack
The breach, which occurred on February 17th, involved ransomware and has been classified by Justice Department officials as “a major incident,” according to the Marshals Service spokesman, Drew J. Wade. The latest security breach highlights the government’s ongoing struggles to safeguard sensitive information as ransomware attacks’ frequency, scale, and sophistication continue to rise in recent years.
The Marshals Service did not specify if a ransom was demanded or if the attackers threatened to release the stolen data. The Department of Justice is investigating the attack’s origin, and the Marshals are working on restoring service and accessing sensitive files via a workaround to avoid delaying ongoing casework.
It is still being determined whether the Marshals have recovered the files or accessed copies from a backup server or other computer system. However, whether the attackers are still considering releasing the stolen data is uncertain. Notably, nation-state adversaries like Iran and Russia have previously launched attacks that looked like ransomware to cover up their efforts to steal intelligence or cause disruption. But the motivation and the threat actor behind this one still remains unclear.
What is the US Marshals Service Doing to Handle the Breach?
The breach was confirmed by US Marshals Service spokesperson Drew Wade, who stated that the affected system contained sensitive information such as returns from legal processes, administrative information, and personally identifiable information of subjects of USMS (United States Marshals Service) investigations, other third parties, and certain USMS employees.
Wade disclosed that the Marshals Service discovered a ransomware and data exfiltration event affecting a standalone USMS system in February. As soon as after discovering the incident, the impacted system was promptly disconnected from the network.
Besides, the Justice Department initiated a forensic investigation into the matter. After the agency briefed senior department officials, it was determined that the security breach constituted a significant incident. While officials with the Marshals Service work to limit the risks posed by the theft of highly sensitive personal and investigative information, the Justice Department is investigating the attack’s origin and assessing the damage caused by the breach.
Data Breach Affected Service Investigations
Although the breach did not involve the database of the Witness Security Program, commonly referred to as the Witness Protection Program, a senior law enforcement official familiar with the matter stated that the incident is still significant. The official revealed that the sensitive information affected pertains to subjects of Marshals Service investigations. Despite the breach, the agency has developed a workaround to continue operations and efforts to track down fugitives.
The Marshals Service immediately disconnected the affected system after discovering the attack. However, the compromised system contains “law enforcement sensitive information, including returns from legal process, administrative information, and PII (Personally Identifiable Information) pertaining to subjects of USMS investigations, third parties, and certain USMS employees,” said Mr. Wade in an email, which means that the scope of the breach is significant and it may cause a lot of damages, and raise questions about the agency’s cybersecurity posture.
Amidst all this, it is recommended that all organizations learn from the attack, focus on cybersecurity, and take steps to protect against ransomware.
How to Protect Against Ransomware?
Here is what organizations can do to protect against ransomware:
- Regularly Back Up all Data: It is important to regularly back up all data to ensure that you can quickly revert to a recent backup in case of any unexpected events. While this won’t completely protect you from being targeted by ransomware attacks, it will help minimize the damage caused by such attacks.
- Keep Software Updated: Keeping software up-to-date is crucial in preventing ransomware attacks. Developers often search for vulnerabilities and release patches to address them. Adopting a patch management strategy and ensuring that all team members know the latest updates is essential.
- Use Better Threat Detection: Implementing an automated threat detection system can significantly reduce the risk of ransomware attacks by helping detect and resolve potential threats before they can cause significant damage.
- Adopt Multi-Factor Authentication: Using MFA is another crucial measure to safeguard your information assets against ransomware attacks. MFA requires users to verify their identity in multiple ways before being granted access to a system, thus making it difficult for attackers to gain access using stolen passwords.
- Use the Principle of Least Privilege: Limiting employee access to data effectively can help you reduce the impact of a ransomware attack. Segmenting the organization and restricting access can create a quarantine effect, limiting access vectors and minimizing the damage caused.
- Scan and Monitor Emails and File Activity: Monitoring emails and file activity is crucial to preventing phishing attacks. An automated email security solution can help block malicious emails from reaching users. Scanning and monitoring file activity can also help detect suspicious behavior and prevent potential threats.
- Improve Employee Training: Investing in employee training is crucial in preventing ransomware attacks, as most attacks are caused by error or ignorance. Proper training can significantly reduce the chances of these incidents.
- Don’t Pay the Ransom: It is never recommended to succumb and pay the ransom demand in case of a ransomware attack, as there is no guarantee that the attacker will keep their word, and you may suffer twice the damage.
Organizations must keep up to date with cybersecurity’s latest and follow CISA’s (Cybersecurity and Infrastructure Security Agency) guidelines to ensure comprehensive phishing protection for their critical data assets.
Final Words
The recent security breach serves as a reminder of the increasing threat of ransomware and data breaches. With the number of attacks on organizations continuing to rise, businesses must take proactive measures to protect themselves and their sensitive information.
By implementing robust security protocols and ensuring all employees are trained in cybersecurity best practices, organizations can significantly reduce the risk of these types of attacks. It is crucial to remain vigilant and take steps to safeguard against potential threats in today’s ever-evolving digital landscape.