Hacker breaks into USDA system; data may be stolen
- By Jason Miller
- Jun 23, 2006
The Agriculture Department last week may have become the latest victim of data theft.
Secretary Mike Johanns alerted employees in the Washington area that a hacker broke into a database at headquarters and may have stolen the names, Social Security numbers and photos of about 26,000 current and former workers and contractors.
The break-in occurred the first weekend in June, and the IT staff found out June 6, said Terri Teuber, USDA's director of communications.
'Initially, the IT folks notified the secretary and said the review of the security analysis said the software had protected the personal information,' Teuber said. 'But further forensics analysis indicated that we could not be sure of that, and yesterday the secretary was advised of the possibility [that] personal information had been accessed, contrary to initial reports.'
Once the possibility of a breach was evident, Johanns ordered notification sent by e-mail and instructed the agency to offer free credit-monitoring services to all employees and former employees for one year.
Teuber said the agency still is figuring out how to pay for it.
USDA's inspector general and law enforcement authorities are investigating the break-in, Teuber said. Additionally, Agriculture's IT staff secured the data and is reviewing security policies and procedures, she said. She could not offer any details about how the staff is doing either.Past failures
USDA has earned an F on its last six Federal Information Security Management Act report cards, but chief information security officer Lynn Allen recently said the agency had 'made significant improvements in our entire security program since last year's FISMA scores.'
USDA set up a call center through 1-800-FEDINFO, and the FirstGov.gov site also has information about the breach.
This is the fifth widely reported data breach in the past month, starting with the Veterans Affairs Department, where a thief stole computer hardware containing the data of 26.5 million current and former military personnel and their spouses. Since then, the IRS, the Energy Department and the Social Security Administration all have been victimized by data loss or theft.
Congress is calling for tighter control over personal data. Rep Tom Davis (R-Va.), chairman of the Government Reform Committee, said he would introduce legislation to strengthen data breach notification requirements at federal agencies.
And Rep James Sensenbrenner (R-Wis.), introduced legislation last month calling for a five-year prison sentence or fine of up to $1 million should a person with knowledge of a major security breach of 10,000 individuals or more, databases owned by the federal government or national security databases fail to notify the FBI or Secret Service within 14 days.