Cyber Incident Victim: U.S. Department of Energy
Date:
Dec 2020
Location:
United States of America
Summary
The U.S. Department of Energy and its National Nuclear Security Administration suffered a network breach by hackers as part of a widespread espionage campaign targeting multiple federal agencies. Unauthorized access to systems was confirmed, prompting coordination with congressional oversight bodies following internal briefings by the agency's chief information officer. The incident compromised networks critical to national security functions, including nuclear weapons stockpile management.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In December 2020, the U.S. Department of Energy (DOE) and the National Nuclear Security Administration (NNSA) confirmed evidence of unauthorized network access by hackers as part of a broader cyber espionage campaign affecting multiple federal agencies. The breach was disclosed internally on December 17, 2020, when DOE Chief Information Officer Rocky Campione briefed agency officials about the compromise. The NNSA, responsible for safeguarding and maintaining the nation’s nuclear weapons stockpile, was among the confirmed breach victims within the DOE complex. Following the briefing, DOE and NNSA leadership initiated mandatory congressional notifications to oversight committees regarding the security incident. The intrusion occurred amid what officials described as a "massive cyber onslaught" targeting at least six federal government entities simultaneously, though the article did not specify exact intrusion timelines or initial detection methods for the DOE breach.
The attackers successfully infiltrated networks operated by both the DOE and its semi-autonomous NNSA subdivision, though the full operational impact remained unquantified in initial reports. No details were provided about whether classified systems or weapons control infrastructure were compromised. The breach formed part of a coordinated espionage operation characterized by its scale and focus on U.S. government agencies. Response actions were immediately prioritized, with interagency coordination led by DOE’s senior information technology leadership. Congressional oversight bodies received formal breach notifications starting December 17, fulfilling legal reporting obligations. The incident highlighted vulnerabilities in critical national security infrastructure during a wave of sophisticated cyber intrusions against government networks.