The U.S. Department of Justice (DoJ) said the SolarWinds hackers gained access to at least one Microsoft 365 account connected to U.S. Attorneys’ offices in 27 districts around the country.
The SolarWinds hack refers to a large-scale attack on multiple government agencies, thousands of private businesses, and other organizations that exploited the SolarWinds Orion software used to manage IT resources. The hack was detected in December 2020, but SolarWinds CEO Sudhakar Ramakrishna said there are signs the attack had started as early as January 2019.
It seems the hackers were particularly interested in New York—or at least their hacking attempts were more successful there—because the Justice Department said they “gained access to the O365 email accounts of at least 80 percent of employees working in the U.S. Attorneys’ offices located in the Eastern, Northern, Southern, and Western Districts of New York.”
“The Department is responding to this incident as if the Advanced Persistent Threat (APT) group responsible for the SolarWinds breach had access to all email communications and attachments found within the compromised O365 accounts,” the DoJ said. “The APT is believed to have access to compromised accounts from approximately May 7 to December 27, 2020.”
The Justice Department also said the “compromised data included all sent, received, and stored emails and attachments found within those accounts during that time.” It notified all of the Microsoft 365 account holders affected by the hack and “provided guidance to identify particular threats” moving forward. Investigations into the SolarWinds hack are ongoing.
