Hack on Transportation Systems Exposes Employee Information

The Department of Transportation’s administrative systems were hacked, exposing the data of hundreds of thousands of employees, the agency confirmed on Monday. 

According to Reuters, the agency notified Congress about the hack late Friday. Transportation confirmed the breach exposed the personal information of approximately 237,000 current and former agency employees.

The affected administrative systems were used, for example, to process employee transit benefits. The agency noted that the breach did not affect any transportation safety systems. 

Transportation’s Office of the Chief Information Officer is investigating the breach, “with the support of other federal agencies, including CISA,” an agency spokesperson told Nextgov in an emailed statement. ”The OCIO is addressing the breach and has suspended access to relevant systems while we further investigate the issue, and secure and restore the systems.” 

It is unclear who is behind the cyber attack, how it occurred and when it was first discovered.

“In an era where the federal government is asking the private sector to do more in terms of cybersecurity, the Department of Transportation breach shows the government needs to follow its own lead and better protect its own systems,” Brandon Pugh, director of Cybersecurity and Emerging Threats at the R Street Institute, told Nextgov in an emailed statement. “All data breaches are concerning, but there are particular risks with information on federal employees being made public. The information could be used to target the impacted federal employees or to carry out future attacks, depending on the precise data that was breached.”

“Cyber attackers require a single vulnerability to infiltrate an organization's network, highlighting the critical importance of fortifying individual systems during a data breach,” Amit Bareket, CEO and co-founder of Perimeter 81, told Nextgov in an emailed statement. “In today's rapidly evolving digital landscape, malicious actors continually devise novel techniques to target organizations and exploit their invaluable resources.”

Bareket noted that “individuals who were affected by the U.S. Department of Transportation data breach should consider a few steps to protect their personal data,” including: changing passwords, utilizing multi factor authentication, monitoring financial accounts and considering identity theft protection. 

The Government Accountability Office’s open priority recommendations to Transportation from July 2022 stated the agency needed to improve its cybersecurity management. A report released Monday also found the agency needs to better implement its cybersecurity policies.

This is the latest hack to affect agencies in recent months. The U.S. Marshals Service was hacked in February and D.C.’s local insurance health portal was breached in March, exposing the personal information of House lawmakers and their staff. 

A growing list of agencies have experienced cybersecurity incidents over the past several years, including the Office of Personnel Management, the Justice Department, the U.S. Agency for International Development and others, in addition to other breaches impacting the commercial software purchased by various agencies.