Attackers exploited flaws in popular software to gather information from various victims. A ministry representative confirmed that at least two units of the agency were affected, although he did not provide further details on the extent of the breach.

what is known

The U.S. Department of Energy took immediate action to prevent further exposure of the vulnerability. He also briefed the Cybersecurity and Infrastructure Security Agency and Congress. Agencies are working with law enforcement, CISA, and affected organizations to investigate the incident and mitigate the consequences of the information leak.

• Among the victims were a contractor for the division’s Office of Science and national laboratories, including Tennessee’s Oak Ridge National Laboratory, which produces uranium for nuclear bombs and conducts nuclear energy research. The Oak Ridge Institute of Science and Education is overseen by the Oak Ridge National Laboratory Office, but spokesperson Pam Bonney said the hacked materials had nothing to do with the national lab.
• The Energy Department’s Waste Isolation Facility in Carlsbad, New Mexico, which stores nuclear waste from the nation’s weapons thousands of feet below the ground, was also affected. On Thursday afternoon, the resort’s website was down. The press secretary declined to comment.

CISA director Jen Easterly said that hackers only stole information stored in the MOVEit file transfer service, and that these intrusions were not used to gain further access to other parts of the networks.