At least nine federal agencies were specifically targeted by the hacking operation, said Anne Neuberger, deputy national security adviser, at a press conference at the White House on Wednesday. At least 100 private sector companies have also been committed.
These figures are the most specific to be released by the government on the scope and scale of the hack, although they have not been changed from previous investigators’ statements. To date, American officials have said that fewer than 10 federal agencies were involved in the campaign.
Neuberger’s comments come amid questions from U.S. lawmakers and policy analysts about who, in the Biden administration, is leading the government’s response to the hack, especially since key functions remain unfilled – including the director of the Cyber Security Agency and Infrastructure of the Department of Homeland Security and the national cyber director, a position recently created by Congress last month.
Neuberger’s brief speech highlighted how the Biden government is still trying to control the devastating breach. She said she has had frequent discussions with lawmakers on the issue, and has promised executive action to address the security gaps that the investigation has revealed so far. The executive action could include at least eight clauses, she said, without revealing details.
Up to 18,000 SolarWinds customers may have been unintentionally affected by a software vulnerability that foreign hackers have quietly inserted into the company’s regular software updates, investigators said earlier.
This vulnerability gave hackers an opening to launch highly personalized tracking attacks, with the aim of compromising specific targets of interest. CNN previously reported that the Agriculture, Commerce, Energy, Homeland Security, Justice, Treasury and State departments were all affected by the hack. In addition, CNN reported that the federal judiciary and the United States Post Office are investigating whether they may have been compromised.
It is still unclear what data the hackers may have accessed, although the Justice Department said that about 3% of its Microsoft email accounts were breached, in the most detailed account ever made of the damage.
The victims of the federal agency were all “highly interested in foreign intelligence,” Neuberger told reporters.
She refused to provide a deadline for the government’s response to the hack.
“Due to the sophistication of the techniques used, we believe that we are in the early stages of understanding scope and scale and can find additional commitments,” said Neuberger.
What is already known about the scope and scale of espionage, however, makes the Russian campaign “more than an isolated case of espionage,” said Neuberger.
Last month, White House press secretary Jen Psaki said the government “will reserve the right to respond at any time and in any way we wish to any cyber attack.”
This story was updated with additional details on Wednesday.