U.S. Treasury, Commerce Department breach, says agency

Two officials told ABC News that Russia was believed to be behind the breach.

U.S. Treasury Department and U.S. Department of Commerce a Cyber ​​breach, ABC News confirmed the agency and the source familiar with the breach.

“We can confirm that there is a breach in one of our bureaus. We have asked the CISA and the FBI for an investigation, and we cannot comment further at this time, “the Commerce Department said in a statement on Sunday.

A source familiar with the investigation told ABC News it was a sophisticated attack and very few companies are capable of it. Officials are investigating and assessing who was behind the breach, which could reach beyond the Treasury and Commerce Department, but two government officials told ABC News that Russia It is believed to be behind the cyber intrusion.

“The United States government is aware of these reports and we are taking all necessary steps to identify and address any potential issues related to this situation,” NSC spokesman John Uliot told ABC News.

The Cyber ​​Security and Infrastructure Security Agency, an arm of the Department of Homeland Security, told ABC News it was assisting in the investigation.

“We are working closely with our agency partners on recent activity on government networks. CISA provides technical assistance to affected companies as they work to identify and mitigate any potential compromises. ”

The CISA on Sunday night offered an emergency directive to “reduce compromise” on software used by the Treasury and Commerce departments and compromised.

Solarwinds, the company that provides the software to these agencies, says it is working with the FBI and law enforcement to get to the bottom of the breach.

“We are aware of potential vulnerabilities, if present, which are currently considered to be related to the improvements that were released for our Orion Monitoring Products between March and June 2020,” Kevin Thompson, president and CEO of Solarwinds, said in a statement. “We believe this vulnerability is the result of a highly sophisticated, targeted and manual supply chain attack by a nation state.”

Under the Homeland Security Act, CISA can provide emergency guidance to federal departments to disconnect software from their servers.

“The compromise of Solarwinds’ Orion network management products poses an unacceptable risk to the security of the federal network,” Brandon Wells, CISA’s executive director, said in a statement on Sunday. “Tonight’s directives are intended to minimize potential compromises in federal citizen networks, and we urge all our partners in the public and private sectors to come into contact with these compromises and protect their networks against any exploitation.”