CGI Federal points finger at Atlassian bug for US government data breach

News
By published

Atlassian software exploit from October 2023 is apparently responsible for the breach

Data breach
(Image credit: Shutterstock)

A bug in the Atlassian collaboration platform is to blame for this week's US government data breach, affected IT contractor CGI Federal has said.

The incident saw the Government Accountability Office (GAO) reveal over 6,000 current and former employees had been affected as a result of the breach.

Article continues below

 Blame it on the buggy

As reported earlier this week, CGI Federal disclosed that it had suffered a data breach at some point during January 2023.

The CGI Federal website states its federal clients, “include nearly every cabinet-level federal agency, military branch, and other federal entities.” A CGI representative recently stated that the company provides its services to “100 participating agencies” while testifying in front of Congress.

In a statement released by CGI Federal, the company said that it was "with authorities and clients to identify and disclose any data affected by the Confluence exploitation." According to the Cybersecurity & Infrastructure Security Agency (CISA), the Atlassian Confluence exploit was discovered in October under the vulnerability ID CVE-2023-22515.

In the statement by CISA on the Network Initial Access exploit, the organization stated that they “strongly encourage network administrators to immediately apply the upgrades provided by Atlassian. CISA, FBI, and MS-ISAC also encourage organizations to hunt for malicious activity on their networks using the detection signatures and indicators of compromise (IOCs) in this CSA.”

More from TechRadar Pro

Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.