The cooling towers and nuclear reactor containment buildings, left, at Plant Vogtle Nuclear Power Plant are shown at the Plant Vogtle in Waynesboro, Ga.

The cooling towers and nuclear reactor containment buildings, left, at Plant Vogtle Nuclear Power Plant are shown at the Plant Vogtle in Waynesboro, Ga. John Bazemore/AP

Foreign Government Agents Suspected of Hacking U.S. Nuclear Regulator

Malware and phishing campaigns compromised the computers of at least a dozen U.S. workers at the Nuclear Regulatory Commission with a technique the Chinese and Russians have used before. By Aliya Sternstein

Nuclear Regulatory Commission computers within the past three years were successfully hacked by foreigners twice and also by an unidentifiable individual, according to an internal investigation.

One incident involved emails sent to about 215 NRC employees in "a logon-credential harvesting attempt," according to an inspector general reportNextgov obtained through an open-records request.

The phishing emails baited personnel by asking them to verify their user accounts by clicking a link and logging in. The link really took victims to "a cloud-based Google spreadsheet."

A dozen NRC personnel took the bait and clicked the link. The IG Cyber Crime Unit was able to "track the person who set up the spreadsheet to a foreign country," the report states, without identifying the nation.

It is unknown what the NRC employees actually put on the spreadsheet, said commission spokesman David McIntyre. "Based on the mere fact of clicking on the link, NRC cleaned their systems and changed their user profiles," he said. 

As the overseer of the U.S. nuclear power industry, NRC maintains records of value to overseas aggressors, including databases detailing the location and condition of nuclear reactors. Plants that handle weapons-grade materials submit information about their inventories to one such system, according to a 2000 IG report on efforts to protect critical infrastructure systems.  

According to the new report, hackers also attacked commission employees with targeted spearphishing emails that linked to malicious software. A URL embedded in the emails connected to "a cloud-based Microsoft Skydrive storage site," which housed the malware, investigators wrote. "There was one incident of compromise and the investigation tracked the sender to a foreign country." Again, the country is not named. 

In another case, intruders broke into the personal email account of an NRC employee and sent malware to 16 other personnel in the employee's contact list. A PDF attachment in the email contained a JavaScript security vulnerability. One of the employees who received the message became infected by opening the attachment, McIntyre said. 

To trace the origins of the attack, investigators subpoenaed an Internet service provider for records regarding the day the initial victim's email account was hacked.

"But the ISP had no log records for that date that were relevant to this incident, since the logs had been destroyed," McIntyre said. It was not possible identify the offender without the logs, the IG assessment states. 

The inspector general in 2010 initiated the report to document possible NRC computer breaches. IG staff tallied 17 compromises or attempted compromises before closing the investigation in November 2013. A similar probe is planned for this year.

McIntyre said the commission is always concerned about the potential for intrusions into its computer networks. Every NRC employee is required to complete annual cyber training that deals with phishing, spearphishing and other attempts to obtain illicit entry into agency networks.

"The NRC’s computer security office detects and thwarts the vast majority of such attempts, through a strong firewall and reporting by NRC employees," he said. "The few attempts documented in the OIG cyber crimes unit report as gaining some access to NRC networks were detected and appropriate measures were taken."

Not Your Common ID Theft

Experts who reviewed the report could not point to a specific attacker, but presumed a foreign government was responsible.

"An organization like the NRC would be a target for nation states seeking information on vulnerabilities in critical infrastructure," said Richard Bejtlich, chief security strategist for cybersecurity company FireEye. A variety of countries, for instance, would be interested in the results of the commission's safety audits, which typically are kept private, he said. 

"Clearly, the spearphishing is a technique that we've seen the Chinese and the Russians use before," said Adam Segal, director of the digital and cyberspace policy program at the Council on Foreign Relations. "Using the general logic, a nation state is going to be more interested in the NRC than you would imagine common criminals would be."

Shawn Henry, a former top FBI cyber official, said another possibility is that the intruders could have been "foreign, but not necessarily tied to a nation state." An overseas individual could be using, perhaps, malware bought off the online black market that is "not specifically targeting NRC, but rather any computer that might inadvertently deploy the malware," said Henry, now president of cyber investigation firm CrowdStrike.

Federal systems are constantly probed by hackers, but those intrusions are not always successful.

Between fiscal years 2010 and 2013, agencies self-reported a more than 35 percent increase in cyber "incidents" or computer security violations -- reaching 46,160 events last year.

Agencies are not required to publicly disclose actual breaches, unless there is evidence personal information has been exposed. 

Notable breaches that have come to light in recent years include an assault on an Energy Department personnel database last summer, where intruders retrieved the names, dates of birth and Social Security numbers of 104,179 individuals. Hackers in 2011 entered a computer containing the SSNs of 123,000 federal employee retirement plan participants. In March, attackers believed to be from China accessed an Office of Personnel Management database containing files on staff who had applied for top secret security clearances. Federal officials say there is no proof yet personal data was taken. 

Just this month came word that Department of Homeland Security employee data likely was compromised when a suspected nation state penetrated a USIS corporate network. USIS conducts personnel investigations on behalf of many agencies.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.