Hack Attack Spills Leidos Internal Docs Online: Report

Leidos has become the latest high-profile victim of a data breach, with hackers reportedly leaking internal documents online. The compromise, which Leidos only recently learned of, is thought to have come by way of a data breach reported by Diligent Corp. last year.

Diligent Corp. is a software-as-a-service provider specializing in governance, risk, and compliance (GRC) solutions. Leidos used Diligent Corp.’s platform to host information related to its internal investigations.

Leidos is one of the Pentagon’s most important vendors, serving the Defense Department and the Department of Homeland Security, among other high-profile agencies.

It is also a prominent player in the biometrics industry. It offers solutions including facial recognition, fingerprint identification, and iris scanning, and its systems have been applied across border security, law enforcement, and secure access control, among other areas.

Like rival IT giants operating in the biometrics space, such as IDEMIA, NEC, and Thales, Leidos has worked on projects related to the FBI’s Criminal Justice Information Services (CJIS) division, which manages the Next Generation Identification system. NGI includes a comprehensive database of biometrics used by law enforcement agencies across the US.

It has also worked on the Department of Homeland Security’s Traveler Verification Service (TVS), a biometric entry and exit system implemented by U.S. Customs and Border Protection (CBP). And Leidos has collaborated with other biometrics vendors: For example, it worked with NEC on a facial recognition-based access management system for the United States Army at Redstone Arsenal Army outpost in Alabama.

Leidos has not yet commented on the leaked data, but a Diligent spokesperson told Bloomberg that the leak appeared to stem from a 2022 hack attack against Steele Compliance Solutions, a firm acquired by Diligent in 2021.

“We promptly notified impacted customers, including Leidos which Diligent initially notified in November 2022, and took immediate corrective action to contain the incident,” the spokesperson said.

Source: Bloomberg

–

July 23, 2024 – by Alex Perala