An internal audit revealed that hackers infiltrated the Nuclear Regulatory Commission at least three times in as many years.
An investigation between 2010 and 2013 by the agency's inspector general found a total of 17 compromises or attempted compromises of NRC cybersecurity, Nextgov reported. Among them, a phishing email sent to 215 NRC employees asked them to verify their account credentials. Twelve clicked on the link, although it's unknown what, if any, information they entered, and the NRC subsequently changed their user profiles. In another instance, links in emails sent to employees directed them to a malicious software download. One computer was compromised. The audit tracked the email senders in both instances to one or more unnamed foreign countries.
In a third incident, hackers accessed an employee's personal email account and sent 16 co-workers a PDF embedded with malware exploiting a JavaScript flaw, infecting one computer. An NRC spokesman told Nextgov that all of the breaches were detected, and that the agency responded appropriately. A similar cybersecurity audit is planned for this year.