U.S. Energy Dept gets two ransom notices as MOVEit hack claims more victims

By Timothy Gardner and Raphael Satter

WASHINGTON (Reuters) -The U.S. Department of Energy got ransom requests from the Russia-linked extortion group Cl0p at both its nuclear waste facility and scientific education facility that were recently hit in a global hacking campaign, a spokesperson said on Friday.

The DOE contractor Oak Ridge Associated Universities and the Waste Isolation Pilot Plant, the New Mexico-based facility for disposal of defense-related radioactive nuclear waste, were hit in the attack, which was first reported on Thursday.

Data was “compromised” at the two DOE entities after hackers breached their systems through a security flaw in the file transfer tool MOVEit Transfer. The software is widely-used by organisations around the world to share sensitive data.

From U.S. government departments to the UK’s telecom regulator and energy giant Shell (LON:), a range of victims have emerged since Burlington, Massachusetts-based Progress Software (NASDAQ:) found the security flaw in its MOVEit Transfer product last month.

The wide-ranging impact of it shows how even the most security-minded federal agencies are struggling to defend against ransomware attacks. Ransomware gangs typically scour for such widely-used tools.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said Thursday that several federal agencies had been hit by the MOVEit breach. It did not say which ones, but added that there had not been much impact to the federal civilian executive branch.

Analysts say more victims are likely to emerge in the coming weeks.

The ransom requests to DOE came in emails to each facility, said the spokesperson, without revealing how much money was demanded. “They came in individually, not as kind of a blind carbon copy,” the spokesperson said. “The two entities that received them did not engage,” with Cl0p and there was no indication the ransom requests were withdrawn, he said.

The DOE, which manages U.S. nuclear weapons and nuclear waste sites related to the military, notified Congress of the breach and is participating in investigations with law enforcement and the CISA.

Cl0p did not respond to requests for comment, but in a post on its website, it said, “WE DON’T HAVE ANY GOVERNMENT DATA” and suggested that should the hackers inadvertently have picked up such data in their mass theft “WE STILL DO THE POLITE THING AND DELETE ALL.”

Recorded Future analyst Allan Liska said Cl0p was likely making a big deal out of how they purportedly deleted government data in an attempt to protect themselves from retaliation from Washington and other governments.