Hacker penetrates USDA database

The Agriculture Department has announced its employees may have become the latest victims of data theft.

Secretary Mike Johanns alerted employees in the Washington area that a hacker broke into a database at headquarters and may have stolen the names, Social Security numbers and photos of about 26,000 current and former workers and contractors.

The cyber break-in happened the first weekend in June, and the IT staff found out June 6, said Terri Teuber, USDA's director of communications.

"Initially, the IT folks notified the secretary and said the review of the security analysis said the software had protected the personal information," Teuber said. "But further forensics analysis indicated that we could not be sure of that, and yesterday the secretary was advised of the possibility [that] personal information had been accessed, contrary to initial reports."

Once the possibility of a breach was evident, Johanns ordered notification sent by e-mail and instructed the agency to offer free credit-monitoring services to all employees and former employees for one year.

Teuber said the agency still is figuring out how they will pay for it.

USDA's inspector general and "the appropriate law enforcement" authorities are investigating the break-in, Teuber said. Additionally, Agriculture's IT staff secured the data and is reviewing security policies and procedures, she said. She could not offer any details about how the staff is doing either.

USDA has earned a F on their last six Federal Information Security Management Act report cards, but chief information security officer Lynn Allen recently said that the agency had "made significant improvements in our entire security program since last year's FISMA scores."

She also could not say whether the cyber break-in occurred from inside the country or outside.

USDA set up a call center through 1-800-FEDINFO, and FirstGov.gov also has information about the breach.

This is the fifth widely reported data breach in the past month, starting with the Veterans Affairs Department, where a thief stole computer hardware containing the data of 26.5 million current and former military personnel and their spouses. Since that May announcement, the IRS, the Energy Department and the Social Security Administration all have been victimized by data loss or theft.

Congress is calling for tighter control over personal data. Rep Tom Davis (R-Va.), chairman of the Government Reform Committee, said he would introduce legislation to strengthen data breach notification requirements at federal agencies.

And Rep James Sensenbrenner (R-Wis.), introduced legislation last month calling for a five-year prison sentence or fine of up to $1 million should a person with knowledge of a major security breach of 10,000 individuals or more, databases owned by the federal government or national security databases fail to notify the FBI or Secret Service within 14 days. The bill was passed by the Judiciary Committee on May 25 and is awaiting a date to be voted on by the full House.

Jason Miller is assistant managing editor of Washington Technology's sister publication, Government Computer News.