Nuclear Regulation Authority: attackers used a known VPN flaw to break into its office network and stole over 250 staff credentials

1. 2020-10-26 17:40

   At about this time, the NRA detected unauthorized traffic that looked like an outside attack. [1]

2. 2020-10-27

   Logs showing an intrusion were found on a server connected to the network staff use for office work. All outside access to the network was cut, and the NRA disclosed the case. [1] [2]

3. 2021-05-20

   The NRA published its findings. [3] [4]

The breached network linked PCs, mail and file sharing servers and printers, and all of the roughly 1,000 staff used it. With outside connections cut, staff had to rely on shared department mail, phone and fax. [1] [2] [3]

Over 250 credentials of staff and contractors were stolen. In October 2020 server configuration files and similar data also appear to have been taken. The NRA said no leak of administrative documents such as staff papers or minutes had been confirmed. [3] [4]

In August and September 2019, attackers exploited a known flaw in a VPN device and stole credentials. Patching of the device was about four months behind at the time. The stolen credentials were used again in September 2019 and March 2020 to get in and look around. [3] [4]

The NRA said it would apply patches promptly and otherwise strengthen security. [3]