The loosely organized hacker group Lulz Security broke into a public portion of the Senate website but did not reach behind a firewall into a more sensitive portion of the network, Martina Bradford, the deputy Senate sergeant at arms, said on Monday.
Despite the breach, the Sergeant at Arms Office, which provides security for the Senate, said that the breach had not compromised any individual senator's information.
Lulz announced the hack on Monday.
“We were responding to their allegations. Basically what we're saying that the server they got into is for public access and is in the public side,” said Bradford.
Lulz Security, who have hacked into Sony's website and the U.S. Public Broadcasting System, posted online a list of files that appear not to be sensitive but indicate the hackers had been into the Senate's computer network.
“We don't like the US government very much,” Lulz Security said at the top of their release. “This is a small, just-for-kicks release of some internal data from Senate.gov — is this an act of war, gentlemen? Problem?”
The comment refers to reports that the US military had decided that it could respond to cyber attacks from foreign countries with traditional military force.
Senate staffers were alerted about the breach late Monday.
“Although this intrusion is inconvenient, it does not compromise the security of the Senate’s network, its members or staff,” Bradford said in a statement. “Specifically, there is no individual user account information on the server supporting senate.gov that could have been compromised.”
“The hackers may have done the equivalent of burglarizing the Senate and bragging because they managed to steal a bunch of souvenirs from the gift shop,” said Stewart Baker, a former cyber official at the Department of Homeland Security. He is now with the law firm Steptoe and Johnson.
The Senate has been the frequent target of hacking attacks, with tens of thousands thwarted each month, Senate Sergeant at Arms Terrance Gainer told Reuters in June.
Still, the break-in is just the latest in a series of embarrassing hacks against companies and organizations.
The International Monetary Fund has been hit, as have Lockheed Martin Corp, Citigroup Inc, Google and Michaels Stores.
The break-in would cause embarrassment at the Senate, said John Bumgarner of the US Cyber Consequences Unit, a think tank.
“They’re all valid directories,” he said after looking at data that Lulz posted online. “This is an especially embarrassing incident for the US Senate, because they are often asking others to explain why their cybersecurity programs have failed.”
“The information disclosed online ... shows that the intruders had administrator-level access to the Senate server. This access could have potentially been used as a jump-off point to compromise other systems in the network,” he said.
Lulz, which is Internet slang for “laugh out loud,” has claimed hacks into websites owned by Sony Corp. It has also claimed responsibility for defacing the US Public Broadcasting Service network websites, and for posting on Monday data from PBS servers to protest a “Front Line” documentary about WikiLeaks.
Lulz claimed credit for breaking into a Fox.com website and publishing data about contestants for the upcoming Fox TV talent show, “X Factor.” Fox is a unit of News Corp.
Another loosely affiliated hacking group, Anonymous, gained prominence when it temporarily crippled the websites of MasterCard, Visa and PayPal after they cut off financial services to WikiLeaks.
It has also attacked websites in Syria, Tunisia, Egypt and India for political reasons.
