A hack at global accounting firm Deloitte shocked the world last month, and further details have been thin on the ground until 10 October.
Citing unnamed sources, the Guardian reported on Tuesday that a server with emails of some 350 clients, including U.S. government agencies, the United Nations and large corporations were compromised in the cyber attack.
"We take any attack on our systems very seriously," the statement said. "We are confident that we know what information was targeted and what the hacker actually did."
There are more than 30 blue-chip companies mentioned in the dossier obtained by The Guardian. Clients that were made vulnerable include the US departments of state, energy, defence and homeland security as well as the National Institutes of Health in the US, the US Postal Service, and Fannie Mae and Freddie Mac (mortgage funders and guarantors).
Deloitte said on 25 September that it was the victim of a cyber attack that affected the data of a small number of clients, providing few details on the breach.
The attack seems to have begun in autumn last year as Deloitte was migrating its email to cloud-based Office 365 at its Hermitage office in Nashville. Hackers allegedly got into the system using an admin account that could, in theory, have given them access to the company’s entire database of emails.
One source said: “The hackers had free rein in the network for a long time and nobody knows the amount of the data taken.” Apparently, Deloitte did not have multifactor authentication at the time of the breach.
The breach at Deloitte, which says its customers include 80 percent of the Fortune 500, is the latest in a series of breaches involving organisations that handle sensitive financial data that have rattled lawmakers, regulators and consumers.
"These are targeted attacks on a financial opportunity," said Shane Shook, an independent consultant who helps financial firms investigate cyber attacks. "This trend is going to continue to grow."
