Attacks/Breaches
12/28/2012
04:07 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

SSNs, Salary Information Exposed In Breach Of Army Servers

'Unknown' attackers access databases of information on 36,000 people

Army officials have confirmed that cybercriminals obtained personal information of 36,000 people from multiple Army commands and visitors to the former Fort Monmouth base via a server hack.

The Army Communications-Electronics Command (CECOM) told The Asbury Park Press that the data breach "may have affected CECOM, C4ISR (Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance) and nongovernmental personnel as well as persons who may have visited Fort Monmouth."

The Fort Monmouth facility was shuttered in September 2011, and the databases storing its information have since been managed by CECOM personnel based at the Aberdeen Proving Ground in Maryland, where CECOPM and C4ISR were relocated after the Fort Monmouth closing.

A CECOM spokesperson told the newspaper that, at the least, names and Social Security numbers were stolen, and that the databases also included birthplace, home addresses, and salary information.

In a Dec. 18 letter to victims whose data was exposed in the breach, CECOM commanding general Maj. Gen. Robert Ferrell said the hack was detected on Dec. 6 and that the breached databases were taken offline.

The databases included information from CECOM Software Engineering Center personnel files and from Fort Monmouth visitor logs, Ferrell said.

The Army's Cyber Command is overseeing the investigation into the breach, and the Army is offering victims free credit-monitoring service for one year. An Army spokesperson says the attack was waged by an "unknown" attacker and its purpose was also unknown.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio