FAA says info on 45,000 workers stolen in data breach
Server break-in nets info on people who were on agency's payroll in February 2006
Computerworld - The Federal Aviation Administration disclosed yesterday that it is investigating a data breach in which the personal data of about 45,000 employees and retirees was apparently stolen from a server at the agency.
The compromise resulted from an intrusion into the system that was storing the data, the FAA said in a brief statement. There are no indications that any of the servers used for air traffic control or other operation systems were similarly broken into, the agency said, adding that it has contacted law enforcement authorities and will notify the affected individuals via mail.
According to the FAA, the server that was breached had a total of 48 files, two of which contained personal data on people who were on the agency's employee rolls as of February 2006. But the FAA's statement didn't say when the breach might have happened or how and when it was discovered, and the agency has yet to respond to a request for further information about the incident.
"The FAA is moving quickly to prevent any similar incidents and has identified immediate steps as well as longer-term measures to further protect personal information," the agency said in the statement. But again, it didn't provide any details about the steps it plans to take.
A employee union official quoted in an Associated Press story that was posted online yesterday before the FAA's disclosure said the other information on the breached server was encrypted medical information. He was also quoted as saying that FAA officials told the union the breach was the first of its kind at the agency.
However, the FAA is merely the latest in a long line of federal agencies to be hit by security breaches, either via system intrusions or the loss or theft of laptop PCs containing unencrypted data.
In the most serious incident thus far, the U.S. Department of Veterans Affairs reported in May 2006 that a laptop and hard drive containing the personal data of 26.5 million military veterans and active-duty personnel had been stolen from an employee's home that month. The laptop and drive were recovered the following month, and VA officials said that the data on them appeared to have been untouched. But the incident sparked an overhaul of the VA's IT department and security changes across the government.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Cybersecurity for Dummies eBook This book provides an in-depth examination of real-world attacks and APTs, the shortcomings of legacy security solutions, the capabilities of next-generation firewalls, and...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different.... All Cybercrime and Hacking White Papers | Webcasts