OMEN
02-04-2009, 10:16 AM
Personal information on employees may have been compromised
Employees at federal security agencies are being notified that their personal information may have been compromised after hackers planted a virus on computer networks of government contractor SRA International Inc.
SRA began notifying its employees and all of its customers after discovering the breach recently, company spokeswoman Sheila Blackwell said today. The malicious software may have allowed hackers to get access to data maintained by SRA, including "employee names, addresses, Social Security numbers, dates of birth and health care provider information," the Fairfax, Va.-based company said in a notification posted at the Maryland attorney general's Web site.
The breach is embarrassing for SRA, a 6,600-employee technology consulting company that sells cybersecurity and privacy services to the federal government. The company wouldn't say which federal agencies were affected by the breach, but in U.S. Securities and Exchange Commission filings, it lists intelligence agencies and the U.S. Department of Defense, the U.S. Department of Homeland Security and the U.S. National Guard among its clients.
The virus was apparently not detected by the company's antivirus software, according to the notification letter. The company said that it is investigating the incident with U.S. government and law enforcement authorities and noted that it has worked with its antivirus vendor to add the ability to detect the malware. SRA didn't say which virus had infected its networks, but it said it believes that other companies may have been hit by the same problem.
Hackers may have also been able to access the data SRA collects in its security position questionnaires, the company said. Those questionnaires are used in screening prospective employees for security jobs.
SRA doesn't know if any data has been compromised, but it's taking the precaution of notifying customers that their data may have been accessed.
IDG
Employees at federal security agencies are being notified that their personal information may have been compromised after hackers planted a virus on computer networks of government contractor SRA International Inc.
SRA began notifying its employees and all of its customers after discovering the breach recently, company spokeswoman Sheila Blackwell said today. The malicious software may have allowed hackers to get access to data maintained by SRA, including "employee names, addresses, Social Security numbers, dates of birth and health care provider information," the Fairfax, Va.-based company said in a notification posted at the Maryland attorney general's Web site.
The breach is embarrassing for SRA, a 6,600-employee technology consulting company that sells cybersecurity and privacy services to the federal government. The company wouldn't say which federal agencies were affected by the breach, but in U.S. Securities and Exchange Commission filings, it lists intelligence agencies and the U.S. Department of Defense, the U.S. Department of Homeland Security and the U.S. National Guard among its clients.
The virus was apparently not detected by the company's antivirus software, according to the notification letter. The company said that it is investigating the incident with U.S. government and law enforcement authorities and noted that it has worked with its antivirus vendor to add the ability to detect the malware. SRA didn't say which virus had infected its networks, but it said it believes that other companies may have been hit by the same problem.
Hackers may have also been able to access the data SRA collects in its security position questionnaires, the company said. Those questionnaires are used in screening prospective employees for security jobs.
SRA doesn't know if any data has been compromised, but it's taking the precaution of notifying customers that their data may have been accessed.
IDG