Cybersecurity vendors own network caught virus

HIT WICKET : Cybersecurity vendors own network caught virus

When this server's a-rockin'...

By Dan Goodin in San Francisco

4th February 2009

http://www.theregister.co.uk/2009/02/04/sra_virus_infection/

SRA International, a government contractor that provides cybersecurity and privacy services, has warned its employees their personal information may have been stolen after hackers planted a virus on its computer network.

The malware was installed on the same network that stored employees' personal data including names, addresses, dates of birth, health information and social security numbers, according to a letter filed with Maryland's Office of Attorney General. Information might also include personal employee details included in security position questionnaires.

Company investigators don't know whether the information has been intercepted but decided it was appropriate to warn employees of the possibility, the letter said. The firm has offered the services of a credit monitoring company to mitigate the chances of identity theft. The breach was reported earlier by IDG News.

The letter didn't say how the virus made its way into a presumably secure network.

"We have shared our findings with our anti-virus vendor and they have updated their virus definitions to detect the virus files we identified," the letter stated. "While we have no specific information, we believe that the security issue may affect more than just SRA."

The letter went on to admonish employees that news of the breach "is company proprietary and should not be discussed externally."

SRA had close to 6,500 employees as of June 30, according to the company's annual shareholder report. The same document went on to praise its computer security savvy.