WASHINGTON — Leading technology companies said Tuesday that a months-long breach of corporate and government networks was so sophisticated, focused and labor-intensive that a nation had to be behind it, with all the evidence pointing to Russia.
In the first congressional hearing on the breach, representatives of technology companies involved in the response described a hack of almost breathtaking precision, ambition and scope. The perpetrators stealthily scooped up specific emails and documents on a target list from the U.S. and other countries.
“We haven’t seen this kind of sophistication matched with this kind of scale,” Microsoft President Brad Smith told the Senate Intelligence Committee.
Forensic investigators have estimated that at least 1,000 highly skilled engineers would have been required to develop the code that hijacked widely used network software from Texas-based SolarWinds to deploy malware around the world through a security update.
U.S. national security officials have also said Russia was likely responsible for the breach, and President Joe Biden’s administration is weighing punitive measures against Russia for the hack as well as other activities. Moscow has denied responsibility for the breach.
Officials have said the motive for the hack, which was discovered by private security company FireEye in December, appeared to be to gather intelligence. On what, they haven’t said.
At least nine government agencies and 100 private companies were breached, but what was taken has not been revealed.
White House press secretary Jen Psaki said Tuesday it would be “weeks not months” before the U.S. responds to Russia.
FireEye CEO Kevin Mandia told the Senate that his company has had nearly 100 people working to study and contain the breach since they detected it, almost by accident, in December and alerted the U.S. government.
The hackers first quietly installed malicious code in October 2019 on targeted networks, but didn’t activate it to see if they could remain undetected. They returned in March and immediately began to steal the log-in credentials of people who were authorized to be on the network so they could have a “secret key” to move around at will, Mandia said.
Once detected “they vanished like ghosts,” he said.
Government agencies breached include the Treasury, Justice and Commerce departments, but the full list has not been publicly released. The president of Microsoft, which is working with FireEye on the response, said there are victims around the world, including in Canada, Mexico, Spain and the United Arab Emirates.
U.S. authorities are considering whether to give additional resources and authority to the Cybersecurity and Infrastructure Agency or other agencies to be able to take a more forceful role in working to prevent future breaches.
Another measure that has been considered is to create a new agency, like the National Transportation Safety Board, that could quickly come in and evaluate a breach and determine whether there are problems that need to be fixed.