US Marshals Ransomware Hit Is 'Major' Incident
Unknown attackers made off with a raft of PII, the Justice Department says — but witnesses in the protection program are still safe.
February 28, 2023
![flags of United States Marshals Service and USA painted on cracked wall flags of United States Marshals Service and USA painted on cracked wall](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt2d7aa668a9881c13/64f162fd00d62184815f4cbf/usmarshals-Daniren-Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The US Marshals Service (USMS), which is tasked with hunting down fugitives and administering the Witness Security Program, was hit with a "major" ransomware incident and data breach in mid-February, officials said.
Despite the ransomware element, USMS's fugitive-hunting operations have continued in the wake of the cyberattack, officials said. However, on Feb. 17, unidentified cyberattackers absconded with a treasure trove of important data, according to Drew Wade, a Justice Department spokesperson.
"The affected system contains law enforcement sensitive information, including returns from legal process, administrative information, and personally identifiable information [PII] pertaining to subjects of USMS investigations, third parties, and certain USMS employees," he told NBC News.
Meanwhile, the outlet cited unnamed sources within the DoJ as confirming that the Witness Security Program (known as the "witness protection program" in films and TV) was not affected.
The attack impacted a "standalone USMS system," Wade said, which was quarantined from the rest of the network. Even so, the incursion should be seen as a "major incident,” he added.
A concrete motive for the attack and the culprits behind it may emerge over the course of the investigation, but targeting the PII could be a prelude to a broader cyber offensive, according to Lior Yaari, CEO and co-founder of Grip Security.
"The US Marshals data breach is another example of how cybercriminals aim for identities — the most common threat target," he says, noting that the data in general would be valuable to a wide range of attacker types. "In this case, attackers were able to exfiltrate and add to the identity fabric for individuals in the USMS system, including prisoners. Compromised identities give cybercriminals an embedded position in identity fabric, thereby extending their presence anywhere and everywhere the identity goes."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024