FBI Portal Suffers Compromise

The notion that every organization is vulnerable to a cyber attack gained further credence this weekend when the FBI suffered a breach to one of its email servers. On Friday, a threat actor exploited a software vulnerability in the FBI’s Law Enforcement Enterprise Portal (LEEP), which is used for communication with state and local law enforcement partners, disseminating over 100,000 fraudulent emails. The adversary discovered the misconfiguration in the LEEP portal’s registration process, allowing them to send out emails from an fbi.gov address. According to an FBI statement, while the threat actor gained access to the LEEP portal, they did not access the agency’s corporate email service nor any personnel or classified information. “Once we learned of the incident, we quickly remediated the software vulnerability, warned partners to disregard the fake emails, and confirmed the integrity of our networks.” Read the official FBI statement on FBI.gov or an overview of the incident at SecurityWeek.