SolarWinds hack compromised U.S. attorneys' offices' Microsoft 365 accounts

The hackers behind the SolarWinds attack gained access to data from 27 U.S. Attorneys' offices.

What you need to know

• The U.S. Department of Justice shared information on the scope of the SolarWinds attacks.
• 27 U.S. Attorneys' offices had at least one employee with a compromised Microsoft 365 account.
• At least 80% of employees working in the Eastern, Northern, Southern, and Western Districts of New York U.S. Attorneys' offices had accounts compromised.

The U.S. Department of Justice shared details regarding how the SolarWinds attack affected federal offices. 27 U.S. Attorneys' offices had at least one employee with a Microsoft 365 account compromised in connection to the SolarWinds attack. Compromised data includes sent, received, and stored emails, as well as email attachments.

"The Department is responding to this incident as if the Advanced Persistent Threat (APT) group responsible for the SolarWinds breach had access to all email communications and attachments found within the compromised O365 accounts," says the U.S. Department of Justice."

It's believed that attackers had access to compromised accounts from approximately May 7 to December 27, 2020.

The U.S. Department of Justice shared a long list of offices that had one or more employees with Microsoft 365 accounts compromised in connection to the SolarWinds attacks:

• Central District of California
• Northern District of California
• District of Columbia
• Northern District of Florida
• Middle District of Florida
• Southern District of Florida
• Northern District of Georgia
• District of Kansas
• District of Maryland
• District of Montana
• District of Nevada
• District of New Jersey
• Eastern District of New York
• Northern District of New York
• Southern District of New York
• Western District of New York
• Eastern District of North Carolina
• Eastern District of Pennsylvania
• Middle District of Pennsylvania
• Western District of Pennsylvania
• Northern District of Texas
• Southern District of Texas
• Western District of Texas
• District of Vermont
• Eastern District of Virginia
• Western District of Virginia
• Western District of Washington

Microsoft President Brad Smith said that the SolarWinds attack was probably "the largest and most sophisticated attack the world has ever seen." The attack targeted private businesses and government agencies. Attackers were able to exploit vulnerabilities in the SolarWinds Orion software to gain access to data.

Previously, Microsoft identified 40 of its customers that were targeted by the SolarWinds attack. The U.S. Department of Justice has accused Russia of being behind the attack.