NASA Discloses Data Breach in Internal Memo

On Tuesday (December 18), NASA disclosed a data breach involving current and former employees. In an internal memo posted to Spaceref, the space agency revealed one of its servers were compromised on October 23.

Personally Identifiable Information Compromised

The report, titled Potential PII Compromise of NASA Servers, revealed the following:

“On Oct. 23, 2018, NASA cybersecurity personnel began investigating a possible compromise of NASA servers where personally identifiable information (PII) was stored.”

While NASA does know that an intruder gained access to a server containing the information of current and former employees, it’s currently unclear exactly what PII the hacker was able to extract. The space agency does not believe any of its missions, which include the InSight lander’s work on Mars, were compromised during the breach.

NASA Waited Nearly Two Months to Notify its Employees

As stated in the report, NASA cybersecurity personnel began investigating the breach on October 23. However, they waited nearly two months to release the report and notify those potentially affected. Due to the nature of NASA’s operations and the highly confidential information on their servers, this comes as no surprise. With agencies like NASA, US law enforcement regularly asks hacked organizations to delay notifying potential victims during an investigation.

“NASA takes cybersecurity very seriously and is committed to devoting the necessary resources to ensure the security of agency information and IT systems,” NASA stated in an emailed statement. In the statement, the agency also noted that it would provide identity protection services to those potentially affected.

NASA Hacked 13 Times in 2011

This isn’t NASA’s first rodeo when it comes to cybersecurity failures. In 2011, while that feels like generations in the past in the scheme of things, NASA suffered 13 separate major network security breaches. In that same year, the agency’s inspector, General Paul K. Martin, told a Congressional panel that only $58 million of its $1.5 BILLION annual IT budget was spent on cybersecurity. Furthermore, General Martin revealed that hackers were able to gain “full, functional control” of NASA’s systems.

It also appears that 2011 was quite an educational year for NASA’s cybersecurity team. Other incidents the space agency incurred include:

• 5,408 minor computer security incidents took place between 2010 and 2011
• Between 2009 and 2011, 48 agency mobile devices, such as unencrypted notebooks, were reported lost or stolen
• Cybercriminals using IP addresses in China managed to compromise the accounts of the most privileged Jet Propulsion laboratory users through multiple attacks in 2011. The hackers gained over 150 employee credentials
• Over the course of the 13 breaches, hackers secured full system access, which allowed them to edit, copy or delete sensitive and confidential files

While the spotlight is currently directed straight at NASA, it is far from the only government agency with cybersecurity issues. Recently, auditors found that the Pentagon’s weapons system and the US ballistic missile system are cybersecurity nightmares. With several cybersecurity experts predicting that World War III could be in the form of cyber warfare, the time for these agencies to make cybersecurity its highest priority is way past due.