NASA says breach compromised server containing employee data

NASA suffered a security breach that may have compromised the personal information of employees dating back more than a decade, the space agency said Tuesday.

“On Oct. 23, 2018, NASA cybersecurity personnel began investigating a possible compromise of NASA servers where personally identifiable information (PII) was stored,” Bob Gibbs, the assistant administrator of NASA’s Office of the Chief Human Capital Officer, wrote in an agency-wide message disclosing the incident.

“After initial analysis, NASA determined that information from one of the servers containing Social Security numbers and other PII data of current and former NASA employees may have been compromised,” the notice said.

NASA secured the servers after becoming aware of the breach and launched an ongoing investigation into the incident alongside unspecified “federal cybersecurity partners,” Mr. Gibbs said.

Investigators are still assessing the scope of the breach, but potentially thousands of past and present NASA employees may have been affected, his note warned.

“NASA Civil Service employees who were on-boarded, separated from the agency, and/or transferred between Centers, from July 2006 to October 2018, may have been affected,” he wrote.

NASA employed over 17,000 people as of 2018.

“Once identified, NASA will provide specific follow-up information to those employees, past and present, whose PII was affected, to include offering identity protection services and related resources, as appropriate,” Mr. Gibbs wrote.

“NASA does not believe that any Agency missions were jeopardized by the cyber incidents,” he added.

Hackers have breached NASA in the past to do damage ranging from defacing agency websites to installing malicious software on sensitive systems.

NASA experienced 5,408 “computer security incidents” between 2010 and 2011, according to a 2012 report released by the agency’s internal watchdog.

More recently, NASA’s Office of the Inspector General said it launched more than 90 investigations into breaches of agency IT networks during the five years preceding publication of a subsequent report released in Nov. 2016.