WASHINGTON: The US Department of Energy and several other federal agencies were hit in a global hacking campaign that exploited a vulnerability in widely used file-transfer software, officials said on Thursday.

Data was “compromised” at two entities within the energy department when hackers gained access through a security flaw in MOVEit Transfer, the department said in a statement.

A DOE official said those entities were the DOE contractor Oak Ridge Associated Universities, and the Waste Isolation Pilot Plant — the New Mexico-based facility for disposal of defence-related nuclear waste.

British energy giant Shell, the University System of Georgia, the Johns Hopkins University and the Johns Hopkins Health System were also hit, all three groups said in separate statements. The latter is a non-profit that collaborates with the university and runs six hospitals and primary care centres.

The new victims add to a growing list of entities in the US, Britain and other countries whose systems were infiltrated through the MOVEit Transfer software. The hackers took advantage of a security flaw that its maker, Progress Software, discovered late last month.

The US Cybersecurity and Infrastructure Security Agency said it was helping several federal agencies that had been breached, but did not name them. “

The energy department, which manages US nuclear infrastructure and energy policy, said it had notified Congress of the breach and is participating in investigations with law enforcement and CISA.

A Shell spokesperson said there was no evidence of impact to Shell’s core IT systems from the MOVEit Transfer-related breach.

Johns Hopkins also said it was “investigating a recent cybersecurity attack targeting a widely used software tool that affected our networks.”

Published in Dawn, June 17th, 2023