Attention, Defense Contractors: You've Been Hacked

China committed about 20 cyberattacks across a year-long period on defense contractors working with the government agency responsible for the transportation of military forces and equipment, according to a newly declassified Senate report.

The Senate Armed Services Committee on Wednesday released the findings of an investigation into the computer intrusions of a sample of contractors that worked with the U.S. Transportation Command in 2012 and 2013. Fifty attempted intrusions were detected, 20 of which were deemed successful and sophisticated enough to pose an advanced threat. All them were linked to Chinese authorities.

Of those 20 intrusions, Transcom was only aware of two of them prior to the committee's investigation, due to failures by the contractors to communicate the breaches to the agency, according to the report. In nine instances, the FBI or Department of Defense was aware of the intrusions but also neglected to report findings to Transcom.

"These peacetime intrusions into the networks of key defense contractors are more evidence of China's aggressive actions in cyberspace," said Sen. Carl Levin, the committee's Democratic chairman. "Our findings are a warning that we must do much more to protect strategically significant share information about intrusions when they do occur."

The report, completed in March of this year, reveals new details about the nature and breadth of international cyber-espionage, estimated to cost the U.S. economy tens of billions of dollars a year. It sheds new light on the aggressive tactics deployed by China to steal valuable information about U.S. military technology and trade secrets, and is sure to add fire to growing concerns in Washington about the threat of industrial spying posed by China and other state actors.

Last month, a Chinese businessman was indicted in California on grounds he hacked into computer networks of Boeing and other defense contractors in an attempt to steal secret documents related to military aircraft

China's hacking of the U.S. is not limited to the military or government organizations. In May, Attorney General Eric Holder announced the indictment of five officers of China's People's Liberation Army for breach attempts made against six American companies.

Last year, the two countries agreed to hold bilateral discussions on cybersecurity and espionage, following a number of warnings from U.S. officials that China's theft of data from American companies could damage relations. China has typically denied such allegations.

The reporting gaps identified by the Senate committee prompted lawmakers to include a provision in the annual National Defense Authorization Act to tighten requirements for defense contractors to report cyberattacks by known or suspected government actors. The provision would also require the Defense Department to create new protocol to help contractors detect and mitigate cyber threats.

"We must ensure that cyber intrusions cannot disrupt our mission readiness" said Sen. Jim Inhofe, the committee's top Republican. "It is essential that we put into place a central clearinghouse that makes it easy for critical contractors, particular those that are small businesses, to report suspicious cyber activity without adding a burden to their mission support operations."

Congress has not yet passed this year's NDAA, but lawmakers have identified as a top priority for the lame-duck session.

(Image via Duc Dao/Shutterstock.com)