Cyber Incident Victim: National Oceanic and Atmospheric Administration
Date:
Nov 2014
Location:
United States of America
Summary
Hackers linked to China infiltrated a U.S. federal weather network, compromising systems operated by the National Oceanic and Atmospheric Administration including the National Weather Service. The breach disrupted access to critical operational data supporting disaster response, aviation safety, maritime operations, and other essential services, prompting cybersecurity teams to isolate affected infrastructure. Officials delayed public acknowledgment of the intrusion for weeks after its discovery, maintaining initial denials about system compromises despite confirmed unauthorized access to sensitive environmental and satellite networks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In late September 2014, hackers operating from China breached the National Oceanic and Atmospheric Administration's federal weather network, compromising systems critical to national infrastructure. The intrusion targeted data essential for disaster planning, aviation operations, maritime shipping, and numerous other operational functions reliant on weather and satellite information. NOAA officials did not publicly acknowledge the compromise when it occurred, nor did they provide immediate indications of system abnormalities. Three individuals with knowledge of the incident confirmed cybersecurity teams within the agency became aware of the breach shortly after its occurrence but maintained operational silence for nearly a month. The delayed disclosure timeline meant external stakeholders, including government partners and private sector entities dependent on NOAA's data streams, remained unaware of potential risks to information integrity during this period.
NOAA's first public reference to cybersecurity issues emerged on October 20, 2014, approximately three weeks after the initial intrusion was detected internally. Agency officials explicitly avoided confirming any system compromise in their communications, despite internal recognition of the breach's occurrence. In response to the intrusion, cybersecurity teams implemented containment measures that involved sealing off compromised data systems. This action restricted access to critical weather and satellite information across multiple sectors that required NOAA's real-time data feeds for daily operations. The forced isolation of these systems disrupted standard data-sharing protocols essential for weather forecasting, emergency management, and transportation safety. No details were disclosed regarding the duration of these restrictions, the specific satellite or weather systems affected, or whether data integrity was permanently compromised by the attackers.