CISA, FBI Officials Say Federal Payroll Facility Was Not Targeted in Hacking Campaigns

The Agriculture Department’s National Finance Center was not targeted by Chinese hackers exploiting network monitoring company SolarWinds products, leading officials told the Senate Homeland Security and Governmental Affairs Committee.

The USDA-controlled National Finance Center runs a payroll system serving over 600,000 federal employees across 160 agencies.

“What I can tell you is that some of the press reports about SolarWinds-related China-based activity were inaccurate,” Tonya Ugoretz, the acting assistant director for the FBI’s cybersecurity division, said. “For me to go into those inaccuracies would require a classified setting.” 

Ugoretz testified before the committee Thursday along with Federal Chief Information Security Officer Christopher DeRusha and Cybersecurity and Infrastructure Security Agency Acting Director Brandon Wales. 

“The National Financing Center was not targeted as far as we know, not as part of this campaign, or the separate campaign, and we've had a number of discussions with the U.S. Department of Agriculture that manages the National Finance Center and do not believe that the NFC was targeted,” Wales testified.

Looking to understand what is being described as a historic breach, senators focused on how agencies communicate with each other and why CISA’s systems did not detect the intrusions. 

The private cybersecurity firm FireEye first disclosed the breach of its own system, likely by nation-state actors, and noted that several government and private organizations around the world were also compromised. Following that revelation in December, U.S. government agencies, including the departments of Commerce and Justice, disclosed their own breaches. Others—the departments of Homeland Security, Defense, Energy and State and the National Institutes of Health—were first reported to have been compromised to varying degrees by news outlets. And Sen. Ron Wyden, D-Ore., publicly shared information on the Treasury Department’s compromise after a briefing for Finance Committee staff.

Anne Neuberger, deputy national security director for cyber and emerging technology, in February said nine federal agencies and about 100 companies were compromised by the hacking campaign, which officials believe is of “likely Russian” origin. But there still is not a definitive list of those affected.

Reuters first reported that, as part of a separate campaign, Chinese hackers had exploited vulnerabilities in SolarWinds software to compromise the payroll facility.

Wales and Ugoretz both expressed support for a national breach notification law that would mandate entities reporting breaches, not just of personally identifiable information such as that of the National Finance Center, but for intrusions into privately owned critical infrastructure.

Committee Chairman Gary Peters, D-Mich., said “in order to adapt to the evolving cybersecurity threat both public and private sector need a centralized, transparent, and streamlined process for sharing information.”   

Wales said agencies are already required to report information on cyber incidents to CISA, whether it affects their sensitive information or their infrastructure, and whether it’s a contractor for the agency or an agency itself.

In response to a question about whether agencies’ contractual arrangements with vendors impedes such information sharing, Wales said the issue does need to be addressed and that interagency guidance is coming soon. 

“There may be some small areas where there are contractual requirements that may need to evolve,” he said. “This is an area that we're actually working with the interagency on now about how we need to evolve certain contracts to make sure information can be shared appropriately, and we expect guidance to come out on that in the very near future.”

Wales also promoted the reauthorization and continued support for CISA’s EINSTEIN detection and Continuous Diagnostics and Mitigation programs. He said both need to be updated but will be foundational for gaining more real-time visibility into agencies cybersecurity posture.