The U.S. Government Accountability Office (GAO) has disclosed a significant data breach involving CGI Federal, a unit of CGI Inc., impacting around 6,000 past and present employees. The breach, reported last month, resulted in the compromise of personally identifiable information (PII), including names, social security numbers, addresses, and some banking details, of individuals who worked at GAO from 2007 to 2017. According to a breach notification letter seen by Reuters, the breach was orchestrated by a threat actor exploiting vulnerabilities in an externally provided platform. However, specific details regarding the nature of the breach were not provided in the notification.
Despite being informed about the breach on January 17, the GAO spokesperson Chuck Young deferred inquiries about the breach’s ramifications to CGI Federal, which had not yet responded to requests for further information. CGI Federal, which has shifted focus towards cybersecurity in recent years, holds numerous contracts with the federal government and provides IT protection to numerous participating agencies. The company’s cybersecurity services extend to several government departments, including State, Justice, Commerce, and Labor, as well as agencies like the Federal Communications Commission and the United States Agency for International Development.
Although CGI Federal’s cybersecurity efforts have expanded, this breach underscores the persistent challenge of safeguarding sensitive data in a digital environment. The breach highlights the ongoing threat posed by cyber attackers exploiting vulnerabilities within external platforms, prompting concerns about the security posture of government contractors handling sensitive information. As investigations into the breach continue, stakeholders await further details on the incident’s impact and measures taken to mitigate its consequences, emphasizing the critical importance of robust cybersecurity measures in protecting individuals’ personal information from malicious actors.
Reference:
