pixel_dreams - Fotolia
The U.S. Department of Energy recorded attacks against its computers 1,131 times during the four years ending Oct. 3, 2014, with attackers gaining access to those computers 159 times, according to records released in response to a Freedom of Information Act request from USA Today. The latest government data breach included 53 successful root exploits.
Andrew Gumbiner, spokesman for the Department of Energy (DOE), said in a prepared statement that "[I]n 2013, DOE experienced two significant intrusions, which led to the potential loss of personally identifiable information (PII) of former and current DOE employees and contractors."
It was unclear whether those intrusions were documented in the released records.
Gumbiner said the DOE would not comment on ongoing investigations or possible attributions of malicious activity, but indicated there is an investigation ongoing.
"In all cases of malicious cybersecurity activity, the Department of Energy seeks to identify indicators of compromise and other cybersecurity relevant information," Gumbiner said, "which it then shares broadly amongst all DOE labs, plants and sites, as well as within the entire federal government."
The DOE Office of Science, which is the lead federal agency supporting fundamental scientific research for energy, and which has responsibility for 10 of the 17 DOE laboratories, sustained 255 attempted attacks of which 90 became successful intrusions, including 28 root exploits.
DOE headquarters systems were targeted most frequently, recording 432 attempts, of which only 13 were successful, including only five root exploits.
Systems in the National Nuclear Security Administration, whose mission includes responsibility "for enhancing national security through the military application of nuclear science," recorded 113 attempts and 19 successful exploits, of which 6 were root exploits.
It is difficult to draw any conclusions from the information reported, which included only the date and time, category -- type of attack and whether it was successful or not -- DOE program office targeted and the status -- either closed or open -- of each attack.
"Without knowing what each department had in place or what each actor was targeting in each office, it's hard to say anything conclusive. That said, it probably indicates the actors encountered differences and variable periods from resource to resource in each office," said Jason Polancich, founder and chief architect of SurfWatch Labs Inc., based in Sterling, Va.
Polancich also suggested that the successful attempts may only be the ones they know about or were able to prove, and there is likely more to be found with more digging.
"The report underscores just how immature our government is when it comes to cybersecurity expertise, defense and budget," Polancich said. "It's likely we could go into any other government department and probably find similar statistics or even something worse, unfortunately. Cybersecurity is not part of their core concerns and certainly not their expertise. Cyberdefense across business and industry is pretty dismal, and this is another big pile of evidence that points to that sad fact."
Learn more about which cyberattacks are worth worrying about.