Does Federal Public Defender, District of Oregon own any subsidiaries ?

Federal Public Defender, District of Oregon has 79 subsidiaries.

Internal validation & live display

Multiple badges & continuous verification

Faster underwriting decisions

https://images.rankiteo.com/companyimages/fd-oregon.jpeg

Federal Public Defender, District of Oregon Company CyberSecurity Posture

fd.org

The Office of the Federal Public Defender, District of Oregon, operates under authority of the Criminal Justice Act of 1964 (CJA), 18 U.S.C. § 3006A. It provides defense services in federal criminal cases and other covered matters to individuals who are financially unable to obtain adequate representation. A person’s eligibility for defender services is determined by the federal court. Defender organization attorneys may not engage in the private practice of law.

Federal Public Defender, District of Oregon A.I CyberSecurity Scoring

FPDDO

Company Details

Linkedin ID:

fd-oregon

Website:

https://or.fd.org/

Employees number:

Number of followers:

631

NAICS:

92211

Industry Type:

Administration of Justice

Homepage:

fd.org

IP Addresses:

Company ID:

FED_2695417

Scan Status:

In-progress

FPDDO Risk Score (AI oriented)

Between 750 and 799

FPDDO Administration of Justice

Updated: 01/12/2025

Powered by our proprietary A.I cyber incident model
Insurance preferes TPRM score to calculate premium

FPDDO Global Score (TPRM)

XXXX

FPDDO Administration of Justice

—

Instant access to detailed risk factors
Benchmark vs. industry & size peers

Vulnerabilities
Findings

FPDDO Company CyberSecurity News & History

Past Incidents

Attack Types

Entity	Type	Severity	Impact	Seen	Incident Details
United States Federal Judiciary (CM/ECF System)	Breach	100	7	6/2020	ADM758081525
Rankiteo Explanation : Attack that could injure or kill people Description: A breach in the United States federal judiciary’s CM/ECF (Case Management/Electronic Case Files) system, discovered around July 4, compromised sealed court records, potentially exposing the identities of confidential informants and cooperating witnesses across multiple states. The attack forced some courts to revert to paper-filing backups, disrupting judicial operations. Reports suggest Russia-linked hackers exploited unpatched software vulnerabilities—some dating back five years—from a prior 2020 breach under the Trump administration. The exposed data may include criminal dockets, arrest warrants, and sealed indictments, though the full scope remains unclear over a month after detection. Security experts criticize the lack of transparency and insufficient logging to reconstruct the attack, raising concerns about repeated targeting of a critical judicial system. The breach risks endangering lives (e.g., witnesses in sensitive cases) and undermining public trust in federal judicial security.
U.S. Federal Judiciary (CM/ECF and PACER systems)	Breach	100		8/2025	ADM831081625
Rankiteo Explanation : Attack threatening the organization’s existence Description: The U.S. federal judiciary’s Case Management/Electronic Case Files (CM/ECF) and PACER systems suffered a sweeping cyber intrusion, exposing sensitive, unclassified data, including witness identities and ongoing criminal investigation details. The breach was exploited by multiple threat actors, including Latin American drug cartels and nation-states, some of whom maintained persistent access for extended periods. The stolen data poses severe risks, as cartels could weaponize the information—potentially endangering witnesses, compromising investigations, or leveraging it for blackmail and coercion. The incident underscores systemic vulnerabilities in federal cybersecurity, exacerbated by the democratization of hacking tools, which lower the barrier for sophisticated attacks. The reactive 'education-by-breach' approach of U.S. agencies has proven inadequate against such diverse, persistent threats, necessitating a centralized, proactive response like shared incident case studies and coordinated security uplifts. The breach not only jeopardizes national security but also erodes public trust in judicial and law enforcement institutions.
U.S. Federal Courts	Breach	100	5	6/2024	ADM806080825
Rankiteo Explanation : Attack threatening the organization's existence Description: The U.S. federal court system experienced a major cyberattack on its case management system, PACER, which contains highly sensitive and sealed documents. The attack exposed vulnerabilities that could have led to the exposure of confidential informants' identities in criminal cases. Officials reported blocking around 200 million harmful cyber events in the 2024 fiscal year, highlighting the persistent and sophisticated nature of the threats. The judiciary is prioritizing security enhancements to mitigate future risks and protect sensitive information.
Administrative Office of the United States Courts (AOUSC)	Breach	100	5	8/2025	ADM413080825
Rankiteo Explanation : Attack threatening the organization's existence Description: The US federal judiciary's case management system was breached by sophisticated threat actors, exposing sensitive court documents across multiple states. The attack compromised confidential informants' identities in criminal cases and other protected information, such as minors' details. Nation-state actors are suspected. The judiciary is implementing stricter access controls and working to mitigate the impact on affected litigants. This incident follows previous attacks on court systems, highlighting the judiciary as a prime target for espionage, disruption, and extortion.
Administrative Office of the U.S. Courts (Federal Judiciary)	Breach	100	5	6/2020	ADM742082525
Rankiteo Explanation : Attack threatening the organization’s existence Description: Hackers, allegedly Russian, breached the federal judiciary’s case management system, exploiting unpatched vulnerabilities that had persisted for at least five years. The attack resulted in the theft of sealed case data, including national security documents (potentially exposing sources/methods) and criminal investigative records (risking witness safety or suspect evasion). The breach may have allowed adversaries to lurk undetected for years, compromising highly sensitive information entrusted to the courts. The judiciary’s response was criticized for lack of transparency, delayed adoption of phishing-resistant multi-factor authentication, and failure to enforce mandatory cybersecurity standards, with Senator Ron Wyden accusing the institution of negligence, incompetence, and covering up past incidents—including a 2020 intrusion by three foreign actors that remains undisclosed. The attack underscores systemic vulnerabilities in an entity responsible for safeguarding critical legal and intelligence data, posing risks to national security, justice processes, and public trust.
U.S. Federal Judiciary	Cyber Attack	100	5	7/2025	ADM805080825
Rankiteo Explanation : Attack threatening the organization's existence Description: The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, which host confidential court documents. While most documents are public, sealed filings containing sensitive information, including identities of confidential informants, were exposed. The attack targeted CM/ECF and PACER, the backbone of federal court document management. The Judiciary is enhancing security measures to block future attacks and mitigate the impact on litigants. The breach was discovered on July 4, 2025, and involved sophisticated and persistent cyber threats.
United States Courts (Federal Court Network)	Cyber Attack	100	5	1/2024	ADM4102141092025
Rankiteo Explanation : Attack threatening the organization's existence Description: The Scattered Spider cybercriminal group, led by Thalha Jubair (19), breached the U.S. Federal Court Network in January 2024 via a helpdesk password reset attack. After gaining access, the group compromised multiple accounts, including those of a federal judge, and stole sensitive personnel data—names, usernames, phone numbers, titles, and work locations of thousands of court employees. They also searched for subpoenas related to their group and attempted unauthorized access to another magistrate judge’s account. Additionally, they used a compromised account to request emergency disclosure of customer financial data from a third-party provider. The breach exposed highly sensitive judicial and administrative records, risking operational disruption, reputational damage, and potential misuse of stolen identities. The attack was part of a broader campaign where Scattered Spider extorted over $115 million from victims, employing ransomware and data theft tactics. The breach threatened the integrity of federal judicial operations, with implications for national security given the targeting of judges and court systems.
Administrative Office of the United States Courts (AOUSC)	Cyber Attack	100	5	6/2020	ADM740081425
Rankiteo Explanation : Attack threatening the organization's existence Description: Russian state-backed attackers exploited long-unpatched vulnerabilities (since 2020) in the CM/ECF/PACER system—a fragmented, outdated digital filing platform used by U.S. federal courts—to exfiltrate sealed legal documents, witness identities, and the court system’s internal blueprints. The breach, part of a multi-year espionage campaign, targeted mid-level criminal cases, particularly those involving individuals with Russian/Eastern European surnames. The attackers leveraged the system’s decentralized, legacy infrastructure (some components dating to the Windows XP era) to maintain persistent access, compromising sensitive judicial data. While no immediate operational disruption was reported, the intrusion exposed systemic vulnerabilities in critical legal infrastructure, risking long-term intelligence exploitation, witness endangerment, and erosion of judicial confidentiality. The attack underscores the strategic targeting of high-value, poorly secured government systems by adversarial nation-states.
United States Courts	Cyber Attack	100	6	01/2021	UNI103024522
Rankiteo Explanation : Attack threatening the economy of a geographical region Description: Corporate Secrets, U.S. federal courts was targeted in a cyberattack that impacted the sensitive information. The compromised information included financial information and trade secrets, including companies’ sales figures, contracts, and product plans. U.S. federal courts immediately secured its networks and informed the impacted members about the breach.

United States Federal Judiciary (CM/ECF System)

Breach

Severity: 100

Impact: 7

Seen: 6/2020

Blog:

ADM758081525

Rankiteo Explanation

Attack that could injure or kill people

Description: A breach in the **United States federal judiciary’s CM/ECF (Case Management/Electronic Case Files) system**, discovered around **July 4**, compromised **sealed court records**, potentially exposing the identities of **confidential informants and cooperating witnesses** across multiple states. The attack forced some courts to revert to **paper-filing backups**, disrupting judicial operations. Reports suggest **Russia-linked hackers** exploited **unpatched software vulnerabilities**—some dating back **five years**—from a prior 2020 breach under the Trump administration. The exposed data may include **criminal dockets, arrest warrants, and sealed indictments**, though the full scope remains unclear over a month after detection. Security experts criticize the lack of transparency and insufficient logging to reconstruct the attack, raising concerns about repeated targeting of a critical judicial system. The breach risks **endangering lives** (e.g., witnesses in sensitive cases) and undermining public trust in federal judicial security.

U.S. Federal Judiciary (CM/ECF and PACER systems)

Breach

Severity: 100

Impact:

Seen: 8/2025

Blog:

ADM831081625

Rankiteo Explanation

Attack threatening the organization’s existence

Description: The U.S. federal judiciary’s **Case Management/Electronic Case Files (CM/ECF) and PACER systems** suffered a **sweeping cyber intrusion**, exposing **sensitive, unclassified data**, including **witness identities and ongoing criminal investigation details**. The breach was exploited by **multiple threat actors**, including **Latin American drug cartels and nation-states**, some of whom maintained **persistent access** for extended periods. The stolen data poses severe risks, as cartels could **weaponize the information**—potentially endangering witnesses, compromising investigations, or leveraging it for blackmail and coercion. The incident underscores systemic vulnerabilities in federal cybersecurity, exacerbated by the **democratization of hacking tools**, which lower the barrier for sophisticated attacks. The **reactive 'education-by-breach' approach** of U.S. agencies has proven inadequate against such **diverse, persistent threats**, necessitating a **centralized, proactive response** like shared incident case studies and coordinated security uplifts. The breach not only jeopardizes **national security** but also erodes public trust in judicial and law enforcement institutions.

U.S. Federal Courts

Breach

Severity: 100

Impact: 5

Seen: 6/2024

Blog:

ADM806080825

Rankiteo Explanation

Attack threatening the organization's existence

Description: The U.S. federal court system experienced a major cyberattack on its case management system, PACER, which contains highly sensitive and sealed documents. The attack exposed vulnerabilities that could have led to the exposure of confidential informants' identities in criminal cases. Officials reported blocking around 200 million harmful cyber events in the 2024 fiscal year, highlighting the persistent and sophisticated nature of the threats. The judiciary is prioritizing security enhancements to mitigate future risks and protect sensitive information.

Administrative Office of the United States Courts (AOUSC)

Breach

Severity: 100

Impact: 5

Seen: 8/2025

Blog:

ADM413080825

Rankiteo Explanation

Attack threatening the organization's existence

Description: The US federal judiciary's case management system was breached by sophisticated threat actors, exposing sensitive court documents across multiple states. The attack compromised confidential informants' identities in criminal cases and other protected information, such as minors' details. Nation-state actors are suspected. The judiciary is implementing stricter access controls and working to mitigate the impact on affected litigants. This incident follows previous attacks on court systems, highlighting the judiciary as a prime target for espionage, disruption, and extortion.

Administrative Office of the U.S. Courts (Federal Judiciary)

Breach

Severity: 100

Impact: 5

Seen: 6/2020

Blog:

ADM742082525

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Hackers, allegedly Russian, breached the federal judiciary’s case management system, exploiting unpatched vulnerabilities that had persisted for at least five years. The attack resulted in the theft of **sealed case data**, including **national security documents** (potentially exposing sources/methods) and **criminal investigative records** (risking witness safety or suspect evasion). The breach may have allowed adversaries to lurk undetected for years, compromising highly sensitive information entrusted to the courts. The judiciary’s response was criticized for **lack of transparency**, **delayed adoption of phishing-resistant multi-factor authentication**, and **failure to enforce mandatory cybersecurity standards**, with Senator Ron Wyden accusing the institution of **negligence, incompetence, and covering up past incidents**—including a 2020 intrusion by three foreign actors that remains undisclosed. The attack underscores systemic vulnerabilities in an entity responsible for safeguarding critical legal and intelligence data, posing risks to **national security, justice processes, and public trust**.

U.S. Federal Judiciary

Cyber Attack

Severity: 100

Impact: 5

Seen: 7/2025

Blog:

ADM805080825

Rankiteo Explanation

Attack threatening the organization's existence

Description: The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, which host confidential court documents. While most documents are public, sealed filings containing sensitive information, including identities of confidential informants, were exposed. The attack targeted CM/ECF and PACER, the backbone of federal court document management. The Judiciary is enhancing security measures to block future attacks and mitigate the impact on litigants. The breach was discovered on July 4, 2025, and involved sophisticated and persistent cyber threats.

United States Courts (Federal Court Network)

Cyber Attack

Severity: 100

Impact: 5

Seen: 1/2024

Blog:

ADM4102141092025

Rankiteo Explanation

Attack threatening the organization's existence

Description: The **Scattered Spider** cybercriminal group, led by **Thalha Jubair (19)**, breached the **U.S. Federal Court Network** in January 2024 via a **helpdesk password reset attack**. After gaining access, the group **compromised multiple accounts**, including those of a **federal judge**, and **stole sensitive personnel data**—names, usernames, phone numbers, titles, and work locations of thousands of court employees. They also **searched for subpoenas** related to their group and **attempted unauthorized access to another magistrate judge’s account**. Additionally, they **used a compromised account to request emergency disclosure of customer financial data** from a third-party provider. The breach exposed **highly sensitive judicial and administrative records**, risking **operational disruption, reputational damage, and potential misuse of stolen identities**. The attack was part of a broader campaign where Scattered Spider **extorted over $115 million** from victims, employing **ransomware and data theft** tactics. The breach **threatened the integrity of federal judicial operations**, with implications for national security given the **targeting of judges and court systems**.

Administrative Office of the United States Courts (AOUSC)

Cyber Attack

Severity: 100

Impact: 5

Seen: 6/2020

Blog:

ADM740081425

Rankiteo Explanation

Attack threatening the organization's existence

Description: Russian state-backed attackers exploited long-unpatched vulnerabilities (since 2020) in the **CM/ECF/PACER** system—a fragmented, outdated digital filing platform used by U.S. federal courts—to exfiltrate **sealed legal documents, witness identities, and the court system’s internal blueprints**. The breach, part of a **multi-year espionage campaign**, targeted mid-level criminal cases, particularly those involving individuals with Russian/Eastern European surnames. The attackers leveraged the system’s **decentralized, legacy infrastructure** (some components dating to the Windows XP era) to maintain persistent access, compromising sensitive judicial data. While no immediate operational disruption was reported, the intrusion exposed systemic vulnerabilities in critical legal infrastructure, risking **long-term intelligence exploitation, witness endangerment, and erosion of judicial confidentiality**. The attack underscores the **strategic targeting of high-value, poorly secured government systems** by adversarial nation-states.

United States Courts

Cyber Attack

Severity: 100

Impact: 6

Seen: 01/2021

Blog:

UNI103024522

Rankiteo Explanation

Attack threatening the economy of a geographical region

Description: Corporate Secrets, U.S. federal courts was targeted in a cyberattack that impacted the sensitive information. The compromised information included financial information and trade secrets, including companies’ sales figures, contracts, and product plans. U.S. federal courts immediately secured its networks and informed the impacted members about the breach.

FPDDO Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒

A.I. Risk Score Predictions locked

Access Monitoring Plan

Underwriter Stats for FPDDO

Incidents vs Administration of Justice Industry Average (This Year)

No incidents recorded for Federal Public Defender, District of Oregon in 2025.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Federal Public Defender, District of Oregon in 2025.

Incident Types FPDDO vs Administration of Justice Industry Avg (This Year)

No incidents recorded for Federal Public Defender, District of Oregon in 2025.

Incident History — FPDDO (X = Date, Y = Severity)

FPDDO cyber incidents detection timeline including parent company and subsidiaries

FPDDO Company Subsidiaries

FPDDO Similar Companies

East Baton Rouge Parish Juvenile Court

http://[email protected]

East Baton Rouge Parish Juvenile Court was created in 1990 by Act 158. Pursuant to Louisiana Revised Statutes 13:1621, Juvenile Court has original jurisdiction over proceedings in the interest of children under seventeen years of age in East Baton Rouge Parish. Accordingly, Juvenile Court has o

Security Report → Compare→

Tribunal Regional Federal da Primeira Região

trf1.jus.br

Constituição Federal de 1988. Art. 108. Compete aos Tribunais Regionais Federais: I - processar e julgar, originariamente: * os juízes federais da área de sua jurisdição, incluídos os da Justiça Militar e da Justiça do Trabalho, nos crimes comuns e de responsabilidade, e os membros do M

Security Report → Compare→

TSJ, Tribunal Supremo de Justicia

gob.ve

El Tribunal Supremo de Justicia, (TSJ) es el máximo órgano del sistema judicial de Venezuela. El Máximo Tribunal es la cabeza del Poder Judicial de la República Bolivariana de Venezuela, sustituyendo en 1999 a la Corte Suprema de Justicia. El mismo se divide en 6 salas o instancias las cuales se

Security Report → Compare→

Florida Office of State Courts Administrator

flcourts.org

Florida's State Courts Administrator serves under the direction of the Chief Justice of the Florida Supreme Court and the other six justices and oversees the operation of court initiatives and administrative functions. Additionally, the State Courts Administrator serves as the liaison between the c

Security Report → Compare→

Louisiana Supreme Court

lasc.org

The Louisiana Constitution distributes the powers of government of the State of Louisiana into three separate branches -- legislative, executive and judicial. Except as provided by the Constitution, no branch of government can exercise the power of another branch of government. This principle is com

Security Report → Compare→

Arizona Supreme Court

azcourts.gov

The Arizona Judicial Branch is an integrated, but decentralized, judicial system implementing its constitutional and statutory responsibilities throughout all levels of government - state, county, and city. The Judicial Branch consists of the Supreme Court, Court of Appeals, Superior Court, and limi

Security Report → Compare→

FPDDO CyberSecurity News

September 10, 2025 07:00 AM

States Struggle to Fill K-12 Cybersecurity Gaps Left by Federal Cuts

A recent report by the Consortium for School Networking found that lawmakers in a handful of states have considered a total of 18 bills in...

Read Article →

April 11, 2025 07:00 AM

Ransomware surge: Sensata Technologies, US state agencies targeted in widespread cyber incidents

Industrial technology company Sensata Technologies disclosed that the company experienced a ransomware attack that encrypted parts of its...

Read Article →

April 10, 2025 07:00 AM

Oregon’s environmental agency shuts down network after cyberattack

Officials at the Oregon Department of Environmental Quality (DEQ) were forced to shut down the organization's network following a cyberattack on Wednesday.

Read Article →

January 17, 2025 04:09 PM

Federal Executive Forum Cybersecurity for Defense and Homeland Progress and Best Practices 2025

Join host Luke McCormack as he explores cybersecurity strategies within DoD and DHS with top government security experts.

Read Article →

July 27, 2023 07:00 AM

Biden nominates 2 US Navy Reserve officers to federal appeals courts

President Joe Biden on Thursday nominated a federal magistrate judge in Indiana and a public defender in Kansas who are both U.S. Navy...

Read Article →

December 30, 2022 08:00 AM

‘It’s broken’ | Judges dismissing cases because no public defenders are available

Portland, Oregon (Atlanta News First) - Staffing shortages are burdening public defender offices across the country, impacting victims as...

Read Article →

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

FPDDO CyberSecurity History Information

Official Website of Federal Public Defender, District of Oregon

The official website of Federal Public Defender, District of Oregon is https://or.fd.org/.

Federal Public Defender, District of Oregon’s AI-Generated Cybersecurity Score

According to Rankiteo, Federal Public Defender, District of Oregon’s AI-generated cybersecurity score is 760, reflecting their Fair security posture.

How many security badges does Federal Public Defender, District of Oregon’ have ?

According to Rankiteo, Federal Public Defender, District of Oregon currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does Federal Public Defender, District of Oregon have SOC 2 Type 1 certification ?

According to Rankiteo, Federal Public Defender, District of Oregon is not certified under SOC 2 Type 1.

Does Federal Public Defender, District of Oregon have SOC 2 Type 2 certification ?

According to Rankiteo, Federal Public Defender, District of Oregon does not hold a SOC 2 Type 2 certification.

Does Federal Public Defender, District of Oregon comply with GDPR ?

According to Rankiteo, Federal Public Defender, District of Oregon is not listed as GDPR compliant.

Does Federal Public Defender, District of Oregon have PCI DSS certification ?

According to Rankiteo, Federal Public Defender, District of Oregon does not currently maintain PCI DSS compliance.

Does Federal Public Defender, District of Oregon comply with HIPAA ?

According to Rankiteo, Federal Public Defender, District of Oregon is not compliant with HIPAA regulations.

Does Federal Public Defender, District of Oregon have ISO 27001 certification ?

According to Rankiteo,Federal Public Defender, District of Oregon is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon operates primarily in the Administration of Justice industry.

Number of Employees at Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon employs approximately 56 people worldwide.

Subsidiaries Owned by Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon presently has no subsidiaries across any sectors.

Federal Public Defender, District of Oregon’s LinkedIn Followers

Federal Public Defender, District of Oregon’s official LinkedIn profile has approximately 631 followers.

NAICS Classification of Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon is classified under the NAICS code 92211, which corresponds to Courts.

Federal Public Defender, District of Oregon’s Presence on Crunchbase

No, Federal Public Defender, District of Oregon does not have a profile on Crunchbase.

Federal Public Defender, District of Oregon’s Presence on LinkedIn

Yes, Federal Public Defender, District of Oregon maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/fd-oregon.

Cybersecurity Incidents Involving Federal Public Defender, District of Oregon

As of December 08, 2025, Rankiteo reports that Federal Public Defender, District of Oregon has experienced 9 cybersecurity incidents.

Number of Peer and Competitor Companies

Federal Public Defender, District of Oregon has an estimated 330 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at Federal Public Defender, District of Oregon ?

Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Breach.

What was the total financial impact of these incidents on Federal Public Defender, District of Oregon ?

Total Financial Loss: The total financial loss from these incidents is estimated to be $115 million.

How does Federal Public Defender, District of Oregon detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with secured its networks, and communication strategy with informed the impacted members about the breach, and incident response plan activated with yes, and containment measures with restricting access to sensitive documents, and remediation measures with implementing more rigorous procedures for document access, and and containment measures with stricter access controls, and remediation measures with enhancing security of the system, and recovery measures with working with courts to mitigate impact on litigants, and communication strategy with published statement, and and and and incident response plan activated with confirmed by administrative office of the us courts (august 5 disclosure), incident response plan activated with norwegian pst (domestic intelligence agency) investigation, and law enforcement notified with norwegian pst, law enforcement notified with us department of justice (implied, though no response confirmed), and communication strategy with public disclosure by us courts (august 5), communication strategy with statements by norwegian pst (via local media), and incident response plan activated with yes (partial; backup paper-filing activated), and law enforcement notified with likely (given federal nature, but not publicly confirmed), and containment measures with isolation of affected cm/ecf components, containment measures with transition to manual filings, and remediation measures with investigation into unpatched vulnerabilities, remediation measures with potential system overhaul (not yet confirmed), and communication strategy with limited public disclosures (via media leaks), communication strategy with no official federal statement as of august 2024, and enhanced monitoring with likely (but not detailed publicly), and law enforcement notified with likely (given federal judiciary involvement), and communication strategy with public disclosure via analysis (lawfare article), communication strategy with likely internal federal briefings, and enhanced monitoring with recommended as part of proposed 'coordinated security uplift', and incident response plan activated with yes (vague 'steps to improve cybersecurity' mentioned), and third party assistance with collaboration with congress, third party assistance with federal agencies (unspecified), and communication strategy with public statement on 2024-08-07 (limited details), communication strategy with no response to 2020 intrusion disclosure, and incident response plan activated with yes (fbi, doj, and international law enforcement), and third party assistance with u.k. national crime agency, third party assistance with west midlands police, third party assistance with city of london police, third party assistance with agencies in canada, romania, australia, and the netherlands, and law enforcement notified with yes (fbi, doj, u.k. authorities), and containment measures with seizure of servers and cryptocurrency wallets ($36m), containment measures with shutdown of scattered spider's telegram channel, and communication strategy with doj complaint unsealing, communication strategy with public statements by fbi/doj officials, communication strategy with media coverage of arrests..

Incident Details

Can you provide details on each incident ?

Incident : Data Breach

Exposure

Impact

Title: Cyberattack on U.S. Federal Courts

Description: Corporate Secrets, U.S. federal courts was targeted in a cyberattack that impacted sensitive information. The compromised information included financial information and trade secrets, including companies’ sales figures, contracts, and product plans. U.S. federal courts immediately secured its networks and informed the impacted members about the breach.

Type: Data Breach

Incident : Data Breach

Exposure

Impact

Title: Cyberattack on US Federal Judiciary Case Management System

Description: The US federal judiciary announced stronger cybersecurity protections for sensitive court documents following escalated cyber-attacks on its case management system. The breach exposed sensitive court documents in multiple US states, with nation-state actors suspected of involvement.

Date Publicly Disclosed: 2024-08-07

Type: Data Breach

Threat Actor: Nation-state actors (suspected)

Motivation: Espionage, disruption, or influence

Incident : Cyberattack

Exposure

Impact

Title: Cyberattack on U.S. Federal Judiciary's Electronic Case Management Systems

Description: The U.S. Federal Judiciary confirms that it suffered a cyberattack on its electronic case management systems hosting confidential court documents and is strengthening cybersecurity measures.

Date Detected: 2025-07-04

Type: Cyberattack

Incident : Cyberattack, Data Breach

Exposure

Impact

Title: Cyberattack on U.S. Federal Court's Case Management System

Description: U.S. federal court officials reported escalated cyberattacks on their case management system, potentially exposing sensitive documents and confidential informant identities. The system, PACER, is considered highly vulnerable and in need of replacement due to cyber risks.

Type: Cyberattack, Data Breach

Incident : Cyber Espionage

Exposure

Impact

Title: Transatlantic Cyberattacks on US Federal Court System and Norwegian Dam by Russian Actors

Description: Russian-linked attackers compromised the US federal court's outdated CM/ECF case-management system, exfiltrating sealed documents, witness identities, and system blueprints over a years-long campaign. Concurrently, suspected Russian cyber operators seized control of a Norwegian dam (Bremanger) for four hours, releasing 500 liters of water per second in a demonstrative attack aimed at instilling fear. Both incidents highlight vulnerabilities in critical Western infrastructure, with US and Norwegian authorities attributing the attacks to Kremlin-aligned actors.

Date Publicly Disclosed: 2024-08-05

Type: Cyber Espionage

Attack Vector: Exploitation of Unpatched Vulnerabilities (since 2020)Compromised Credentials (implied for court system)Remote Access to Industrial Control Systems (dam)

Vulnerability Exploited: Legacy System Vulnerabilities (CM/ECF/PACER platforms, some running on outdated Windows XP-era software)Unspecified bugs in dam control systems

Threat Actor: Russian State-Sponsored Actors (suspected)Kremlin-Aligned Cyber Groups

Motivation: Espionage (US court documents, particularly cases involving Russian/Eastern European surnames)Demonstration of Capability (Norwegian dam attack to instill fear)Geopolitical Signaling

Incident : Data Breach

Exposure

Impact

Title: Breach of the United States Federal Judiciary’s Electronic Case Filing System (CM/ECF)

Description: A cybersecurity breach of the United States federal judiciary’s **Case Management/Electronic Case Files (CM/ECF)** system was discovered around **July 4**. The incident compromised **sealed court records** and may have exposed the identities of **confidential informants and cooperating witnesses** across multiple U.S. states. Some courts reverted to **backup paper-filing plans** as a result. The breach exploited **unpatched software vulnerabilities** first identified **five years ago** during a **2020 incident** under the first Trump administration. Reports suggest **Russian involvement**, but details on affected data and systems remain unclear over a month after discovery. The compromised system manages **criminal dockets, arrest warrants, and sealed indictments**.

Date Detected: 2024-07-04 (approximate)

Date Publicly Disclosed: 2024-08-06 (via Politico and The New York Times reports)

Type: Data Breach

Attack Vector: Exploitation of unpatched software vulnerabilities (known since 2019)Potential state-sponsored (Russia alleged)

Vulnerability Exploited: Unaddressed software vulnerabilities in CM/ECF system (identified in 2019 after a prior 2020 breach)

Threat Actor: Allegedly linked to Russia (unconfirmed)State-sponsored actors (suspected)

Motivation: EspionageIntelligence gatheringCompromise of sensitive legal proceedings

Incident : Cyber Espionage

Exposure

Impact

Title: Cyber Intrusion into U.S. Federal Judiciary’s CM/ECF and PACER Systems

Description: A sweeping cyber intrusion exposed sensitive, unclassified information in the U.S. federal judiciary’s Case Management/Electronic Case Files (CM/ECF) and PACER systems. The breach revealed witness identities and details of ongoing criminal investigations, raising concerns about Latin American drug cartels weaponizing the stolen data. Multiple nation-states and criminal groups simultaneously breached these systems, with some maintaining prolonged access. The incident underscores systemic vulnerabilities in U.S. federal agencies, exacerbated by the 'democratization of hacking' and a reactive 'education-by-breach' cybersecurity approach. Current strategies, including offensive cyber operations, are deemed insufficient against the diverse threat landscape.

Type: Cyber Espionage

Attack Vector: Unknown (likely multi-vector due to diverse threat actors)Potential exploitation of systemic vulnerabilities in federal IT infrastructure

Vulnerability Exploited: Systemic weaknesses in U.S. federal cybersecurity postureLack of proactive threat detection and centralized incident response

Threat Actor: Latin American Drug Cartels (potential weaponization of data)Multiple Nation-StatesVarious Criminal Groups

Motivation: EspionageCriminal Exploitation (e.g., witness intimidation, investigation sabotage)Financial Gain (potential dark web data sales)Strategic Advantage (nation-state actors)

Incident : data breach

Exposure

Impact

Title: Federal Court Cybersecurity Breach Involving Sealed Case Data

Description: Hackers, allegedly Russian, breached and stole sealed case data from federal district courts dating back to at least July 2024, exploiting vulnerabilities left unfixed for five years. The breach follows a 2020 intrusion by three hostile foreign actors, which remains undisclosed in detail. Sen. Ron Wyden accused the judiciary of negligence, incompetence, and covering up failures, urging Chief Justice John Roberts to seek an independent review by the National Academy of Sciences. The judiciary's slow adoption of non-phishing-resistant multifactor authentication and lack of accountability were highlighted as key issues. The Administrative Office of the U.S. Courts acknowledged the attack but provided vague details about remediation efforts.

Date Publicly Disclosed: 2024-08-07

Type: data breach

Attack Vector: exploitation of unpatched vulnerabilitiespersistent access (potentially years)weak multifactor authentication

Vulnerability Exploited: Unpatched vulnerabilities in the case management system (left unfixed for ~5 years)

Threat Actor: Alleged Russian hackers (same group linked to a prior 2020 intrusion)

Motivation: cyberespionagenational security compromisepotential witness/defendant targeting

Incident : Cyber Extortion

Exposure

Impact

Title: Scattered Spider Cybercriminal Operation Extorts $115M, Breaches U.S. Federal Court Network

Description: A Justice Department complaint revealed that the Scattered Spider cybercriminal group, including U.K. national Thalha Jubair (19), conducted at least 120 cyberattacks over three years, extorting at least $115 million from victims, including 47 U.S. entities. The group breached the U.S. federal court network via helpdesk social engineering, stealing personnel data and searching for subpoenas. Jubair was arrested in London and faces U.S. charges for conspiracies involving computer fraud, wire fraud, and money laundering. The group's tactics included calling help desks to reset passwords, taking over administrative accounts, and encrypting systems after data theft. Evidence tied Jubair to servers, cryptocurrency wallets (including $36M seized), Telegram accounts, and gaming/food delivery purchases. The group also targeted Transport for London and industries like insurance, retail, and aviation.

Date Publicly Disclosed: 2024-07-18

Type: Cyber Extortion

Attack Vector: Helpdesk Impersonation (Password Reset)Credential TheftAdministrative Account TakeoverData ExfiltrationSystem Encryption

Vulnerability Exploited: Weak Helpdesk AuthenticationLack of Multi-Factor Authentication (MFA)Human Error (Social Engineering)

Threat Actor: Scattered SpiderThalha Jubair (19, U.K. national)Owen Flowers (18, U.K. national)Unnamed U.S.-based co-conspirator

Motivation: Financial GainData Theft for ExtortionDisruption of Critical Infrastructure

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Breach.

How does the company identify the attack vectors used in incidents ?

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Exploited vulnerabilities in CM/ECF system (US)Compromised dam control system credentials/access (Norway), Exploited unpatched vulnerabilities in CM/ECF system (2019-era flaws), unpatched vulnerabilities in case management system and Helpdesk password reset requests.

Impact of the Incidents

What was the impact of each incident ?

Incident : Data Breach UNI103024522

Data Compromised: Financial information, Trade secrets, Sales figures, Contracts, Product plans

Incident : Data Breach ADM413080825

Data Compromised: Confidential court documents, identities of confidential informants

Systems Affected: Federal core case management system

Operational Impact: Mitigation efforts to restrict access to sensitive documents

Brand Reputation Impact: Potential distrust in the US government

Identity Theft Risk: High (confidential informants and protected identities)

Incident : Cyberattack ADM805080825

Data Compromised: Sensitive case documents, Identities of confidential informants

Systems Affected: CM/ECFPACER

Operational Impact: Mitigation efforts with courts to reduce impact on litigants

Identity Theft Risk: High

Incident : Cyberattack, Data Breach ADM806080825

Data Compromised: Sensitive documents, Potential exposure of confidential informant identities

Systems Affected: Public Access to Court Electronic Records (PACER)

Incident : Cyber Espionage ADM740081425

Data Compromised: Sealed court documents, Witness identities, Us court system blueprints, Midlevel criminal case files (nyc and other jurisdictions)

Systems Affected: US Courts' CM/ECF (Case Management/Electronic Case Files) systemPACER (Public Access to Court Electronic Records)Bremanger Dam Control Systems (Norway)

Downtime: ['4 hours (Bremanger dam valves held open)']

Operational Impact: Disruption of dam operations (Norway)Potential compromise of legal proceedings (US)Loss of control over sensitive case materials

Brand Reputation Impact: Erosion of public trust in US federal court system securityPerception of vulnerability in Norwegian critical infrastructure

Legal Liabilities: Potential violations of confidentiality for sealed court casesRisk of compromised legal proceedings

Identity Theft Risk: ['High (witness identities exposed)']

Incident : Data Breach ADM758081525

Data Compromised: Sealed court records, Confidential informant identities, Cooperating witness identities, Criminal dockets, Arrest warrants, Sealed indictments

Systems Affected: Case Management/Electronic Case Files (CM/ECF) systemBackup paper-filing systems (activated as contingency)

Downtime: Ongoing (as of August 2024, partial disruptions persist)

Operational Impact: Court operations disruptedTransition to manual paper filingsDelayed legal proceedings

Brand Reputation Impact: Erosion of public trust in federal judiciary cybersecurityCriticism over repeated breaches (2020 and 2024)

Legal Liabilities: Potential lawsuits from exposed individuals (e.g., informants, witnesses)Violations of confidentiality agreements

Identity Theft Risk: ['High (for confidential informants and witnesses)', 'Risk of retaliation or physical harm']

Incident : Cyber Espionage ADM831081625

Data Compromised: Witness identities, Details of ongoing criminal investigations, Sensitive unclassified judicial records

Systems Affected: Case Management/Electronic Case Files (CM/ECF)Public Access to Court Electronic Records (PACER)

Operational Impact: Compromised integrity of judicial proceedingsRisk to witness safetyErosion of trust in federal judiciary cybersecurity

Brand Reputation Impact: Severe damage to public trust in U.S. federal judiciary’s ability to protect sensitive dataPerception of systemic cybersecurity failures across federal agencies

Identity Theft Risk: ['High (for witnesses and individuals involved in criminal cases)']

Incident : data breach ADM742082525

Data Compromised: Sealed case data, Potential national security documents, Criminal charging/investigative documents

Systems Affected: federal district court case management system

Operational Impact: compromised confidentiality of sensitive legal proceedingsrisk to sources/methods in national security casespotential witness/defendant endangerment

Brand Reputation Impact: eroded public trust in federal judiciary's cybersecurityaccusations of negligence/cover-up by Sen. Wyden

Incident : Cyber Extortion ADM4102141092025

Financial Loss: $115 million (ransom payments)

Data Compromised: Personnel data (names, usernames, telephone numbers), Federal judge subpoenas, Thousands of names, titles, and work locations of u.s. courts users, Customer account information (requested via financial services provider)

Systems Affected: U.S. Federal Court NetworkSeven victim companies (unnamed)Transport for London (2023)47 U.S. entitiesCompanies in insurance, retail, and aviation industries

Operational Impact: Widespread disruption to U.S. businessesDisruption to critical infrastructureFederal court system compromiseEmergency disclosure requests to financial services providers

Brand Reputation Impact: High (targeting of federal systems and critical infrastructure)Public association with Scattered Spider's high-profile attacks

Legal Liabilities: Potential lawsuits from affected entitiesRegulatory scrutiny for U.S. Courts and victim companies

Identity Theft Risk: ['High (PII of court personnel and users exposed)']

Payment Information Risk: ['Moderate (customer account information requested via financial services provider)']

What is the average financial loss per incident ?

Average Financial Loss: The average financial loss per incident is $12.78 million.

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Financial Information, Trade Secrets, Sales Figures, Contracts, Product Plans, , Confidential court documents, identities of confidential informants, Sensitive Case Documents, Identities Of Confidential Informants, , Sensitive Documents, Sealed Materials, , Sealed Legal Documents, Witness Identities, Court System Architectural Blueprints, Case Files (Including Those With Russian/Eastern European Surnames), , Legal Documents, Sealed Records, Personally Identifiable Information (Pii) Of Informants/Witnesses, Criminal Case Details, , Personally Identifiable Information (Pii) Of Witnesses, Criminal Investigation Details, Unclassified Judicial Records, , Sealed Court Records, National Security Documents, Criminal Investigative Files, , Personally Identifiable Information (Pii), Employment Records, Judicial Subpoenas, Customer Account Information and .

Which entities were affected by each incident ?

Incident : Data Breach UNI103024522

Entity Name: U.S. Federal Courts

Entity Type: Government

Industry: Judiciary

Location: United States

Incident : Data Breach ADM413080825

Entity Name: Administrative Office of the United States Courts (AOUSC)

Entity Type: Government

Industry: Judicial

Location: United States

Incident : Cyberattack ADM805080825

Entity Name: U.S. Federal Judiciary

Entity Type: Government Agency

Industry: Judicial

Location: United States

Incident : Cyberattack, Data Breach ADM806080825

Entity Name: U.S. Federal Courts

Entity Type: Government

Industry: Judicial

Location: United States

Incident : Cyber Espionage ADM740081425

Entity Name: Administrative Office of the United States Courts

Entity Type: Government Agency

Industry: Judicial/Legal

Location: United States

Customers Affected: Lawyers, Court personnel, Individuals involved in sealed cases (particularly those with Russian/Eastern European surnames)

Incident : Cyber Espionage ADM740081425

Entity Name: Bremanger Dam

Entity Type: Critical Infrastructure

Industry: Energy/Water Management

Location: Bremanger, Norway

Customers Affected: Local population downstream of the dam, Norwegian water management authorities

Incident : Data Breach ADM758081525

Entity Name: United States Federal Judiciary

Entity Type: Government Agency

Industry: Judicial/Legal

Location: United States (multiple states)

Size: Federal-level (all U.S. district courts using CM/ECF)

Customers Affected: Confidential informants, Cooperating witnesses, Defendants in sealed cases, Legal professionals

Incident : Cyber Espionage ADM831081625

Entity Name: Administrative Office of the U.S. Courts (AOUSC)

Entity Type: Federal Government Agency

Industry: Judicial/Legal

Location: United States

Size: Large (federal-scale operations)

Customers Affected: Judges, Prosecutors, Defendants, Witnesses, Legal professionals, General public accessing court records

Incident : data breach ADM742082525

Entity Name: Administrative Office of the U.S. Courts

Entity Type: federal agency

Industry: judicial/government

Location: United States

Incident : Cyber Extortion ADM4102141092025

Entity Name: United States Courts

Entity Type: Federal Government

Industry: Judicial/Legal

Location: United States

Customers Affected: Thousands (court personnel and users)

Incident : Cyber Extortion ADM4102141092025

Entity Name: Transport for London

Entity Type: Government Agency

Industry: Transportation

Location: United Kingdom

Incident : Cyber Extortion ADM4102141092025

Entity Name: 47 Unnamed U.S. Entities

Entity Type: Private Companies, Critical Infrastructure

Industry: Insurance, Retail, Aviation, Others

Location: United States

Incident : Cyber Extortion ADM4102141092025

Entity Name: Seven Victim Companies (from complaint)

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Data Breach UNI103024522

Containment Measures: secured its networks

Communication Strategy: informed the impacted members about the breach

Incident : Data Breach ADM413080825

Incident Response Plan Activated: Yes

Containment Measures: Restricting access to sensitive documents

Remediation Measures: Implementing more rigorous procedures for document access

Incident : Cyberattack ADM805080825

Incident Response Plan Activated: True

Containment Measures: Stricter access controls

Remediation Measures: Enhancing security of the system

Recovery Measures: Working with courts to mitigate impact on litigants

Communication Strategy: Published statement

Incident : Cyberattack, Data Breach ADM806080825

Incident Response Plan Activated: True

Incident : Cyber Espionage ADM740081425

Incident Response Plan Activated: ['Confirmed by Administrative Office of the US Courts (August 5 disclosure)', 'Norwegian PST (domestic intelligence agency) investigation']

Law Enforcement Notified: Norwegian PST, US Department of Justice (implied, though no response confirmed),

Communication Strategy: Public disclosure by US Courts (August 5)Statements by Norwegian PST (via local media)

Incident : Data Breach ADM758081525

Incident Response Plan Activated: Yes (partial; backup paper-filing activated)

Law Enforcement Notified: Likely (given federal nature, but not publicly confirmed)

Containment Measures: Isolation of affected CM/ECF componentsTransition to manual filings

Remediation Measures: Investigation into unpatched vulnerabilitiesPotential system overhaul (not yet confirmed)

Communication Strategy: Limited public disclosures (via media leaks)No official federal statement as of August 2024

Enhanced Monitoring: Likely (but not detailed publicly)

Incident : Cyber Espionage ADM831081625

Law Enforcement Notified: Likely (given federal judiciary involvement),

Communication Strategy: Public disclosure via analysis (Lawfare article)Likely internal federal briefings

Enhanced Monitoring: Recommended as part of proposed 'coordinated security uplift'

Incident : data breach ADM742082525

Incident Response Plan Activated: Yes (vague 'steps to improve cybersecurity' mentioned)

Third Party Assistance: Collaboration With Congress, Federal Agencies (Unspecified).

Communication Strategy: public statement on 2024-08-07 (limited details)no response to 2020 intrusion disclosure

Incident : Cyber Extortion ADM4102141092025

Incident Response Plan Activated: Yes (FBI, DOJ, and international law enforcement)

Third Party Assistance: U.K. National Crime Agency, West Midlands Police, City Of London Police, Agencies In Canada, Romania, Australia, And The Netherlands.

Law Enforcement Notified: Yes (FBI, DOJ, U.K. authorities)

Containment Measures: Seizure of servers and cryptocurrency wallets ($36M)Shutdown of Scattered Spider's Telegram channel

Communication Strategy: DOJ complaint unsealingPublic statements by FBI/DOJ officialsMedia coverage of arrests

What is the company's incident response plan?

Incident Response Plan: The company's incident response plan is described as Yes, , , Confirmed by Administrative Office of the US Courts (August 5 disclosure), Norwegian PST (domestic intelligence agency) investigation, , Yes (partial; backup paper-filing activated), Yes (vague 'steps to improve cybersecurity' mentioned), Yes (FBI, DOJ, and international law enforcement).

How does the company involve third-party assistance in incident response ?

Third-Party Assistance: The company involves third-party assistance in incident response through collaboration with Congress, federal agencies (unspecified), , U.K. National Crime Agency, West Midlands Police, City of London Police, Agencies in Canada, Romania, Australia, and the Netherlands, .

Data Breach Information

What type of data was compromised in each breach ?

Incident : Data Breach UNI103024522

Type of Data Compromised: Financial information, Trade secrets, Sales figures, Contracts, Product plans

Sensitivity of Data: High

Incident : Data Breach ADM413080825

Type of Data Compromised: Confidential court documents, identities of confidential informants

Sensitivity of Data: High

Data Exfiltration: Yes

Personally Identifiable Information: Yes

Incident : Cyberattack ADM805080825

Type of Data Compromised: Sensitive case documents, Identities of confidential informants

Sensitivity of Data: High

Incident : Cyberattack, Data Breach ADM806080825

Type of Data Compromised: Sensitive documents, Sealed materials

Sensitivity of Data: high

Incident : Cyber Espionage ADM740081425

Type of Data Compromised: Sealed legal documents, Witness identities, Court system architectural blueprints, Case files (including those with russian/eastern european surnames)

Sensitivity of Data: High (sealed indictments, witness protection details, system blueprints)

Data Exfiltration: Confirmed (US court documents)Unspecified for Norwegian dam (though control was seized)

File Types Exposed: PDF (legal documents)Database records (case files)System diagrams (blueprints)

Personally Identifiable Information: Witness identitiesNames/details from criminal cases

Incident : Data Breach ADM758081525

Type of Data Compromised: Legal documents, Sealed records, Personally identifiable information (pii) of informants/witnesses, Criminal case details

Sensitivity of Data: Extremely High (national security, witness protection, ongoing investigations)

Data Exfiltration: Suspected (but unconfirmed)

File Types Exposed: PDF (court filings)Database records (case management)Text documents (indictments, warrants)

Personally Identifiable Information: Names of confidential informantsWitness identitiesCase participant details

Incident : Cyber Espionage ADM831081625

Type of Data Compromised: Personally identifiable information (pii) of witnesses, Criminal investigation details, Unclassified judicial records

Sensitivity of Data: High (potential to endanger lives, compromise investigations)

Data Exfiltration: Confirmed (data stolen by multiple actors)

File Types Exposed: Case filesWitness statementsInvestigation documents

Personally Identifiable Information: Witness identitiesPossibly addresses, contact details, or other PII linked to criminal cases

Incident : data breach ADM742082525

Type of Data Compromised: Sealed court records, National security documents, Criminal investigative files

Sensitivity of Data: High (includes classified/national security and legally sensitive materials)

Data Exfiltration: Confirmed (stolen sealed case data)

Incident : Cyber Extortion ADM4102141092025

Type of Data Compromised: Personally identifiable information (pii), Employment records, Judicial subpoenas, Customer account information

Number of Records Exposed: Thousands (exact number unspecified)

Sensitivity of Data: High (includes PII of federal employees and judicial records)

Data Exfiltration: Yes (downloaded from U.S. Courts network)

Data Encryption: Yes (used in ransomware attacks)

File Types Exposed: Personnel databasesEmail inboxes (including federal judges)Subpoena documents

Personally Identifiable Information: NamesUsernamesTelephone numbersTitlesWork locations

What measures does the company take to prevent data exfiltration ?

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Implementing more rigorous procedures for document access, Enhancing security of the system, Investigation into unpatched vulnerabilities, Potential system overhaul (not yet confirmed), .

How does the company handle incidents involving personally identifiable information (PII) ?

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by secured its networks, , restricting access to sensitive documents, stricter access controls, isolation of affected cm/ecf components, transition to manual filings, , seizure of servers and cryptocurrency wallets ($36m), shutdown of scattered spider's telegram channel and .

Ransomware Information

Was ransomware involved in any of the incidents ?

Incident : Cyber Espionage ADM740081425

Data Exfiltration: ['Yes (US court system)']

Incident : Data Breach ADM758081525

Data Exfiltration: Possible (motive aligns with espionage)

Incident : Cyber Espionage ADM831081625

Data Exfiltration: ['Yes (primary objective of intrusion)']

Incident : Cyber Extortion ADM4102141092025

Ransom Demanded: ['$25 million (one victim)', '$36.2 million (another victim)', 'Total: $115 million across all victims']

Ransom Paid: $115 million (total across all victims)

Data Encryption: Yes (critical systems encrypted after data theft)

Data Exfiltration: Yes (double extortion tactic)

How does the company recover data encrypted by ransomware ?

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Working with courts to mitigate impact on litigants.

Regulatory Compliance

Were there any regulatory violations and fines imposed for each incident ?

Incident : Cyber Espionage ADM740081425

Regulations Violated: Potential violations of US federal rules on sealed court documents (e.g., Federal Rule of Criminal Procedure 6(e) for grand jury secrecy), Norwegian critical infrastructure protection laws,

Regulatory Notifications: Disclosure to US Congress/oversight bodies (implied)Norwegian government notifications

Incident : Data Breach ADM758081525

Regulations Violated: Federal Rules of Criminal Procedure (sealed records), Potential violations of the **Privacy Act of 1974** (PII exposure), Judicial Conference policies on data security,

Legal Actions: Potential congressional hearings, Internal judicial reviews,

Regulatory Notifications: Likely notified to **Department of Justice (DOJ)** and **Homeland Security (DHS)**

Incident : Cyber Espionage ADM831081625

Regulations Violated: Potential violations of Federal Information Security Modernization Act (FISMA), Possible non-compliance with judicial data protection policies,

Regulatory Notifications: Likely notifications to Congress, Department of Justice, and other oversight bodies

Incident : data breach ADM742082525

Regulations Violated: potential violations of federal cybersecurity mandates (unspecified), failure to meet basic cybersecurity best practices,

Legal Actions: Sen. Wyden's call for independent review by National Academy of Sciences,

Incident : Cyber Extortion ADM4102141092025

Legal Actions: U.S. charges against Thalha Jubair (computer fraud, wire fraud, money laundering), Potential extradition from U.K., Up to 95 years in prison if convicted,

Regulatory Notifications: DOJ complaint filingFBI statementsInternational law enforcement coordination

How does the company ensure compliance with regulatory requirements ?

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential congressional hearings, Internal judicial reviews, , Sen. Wyden's call for independent review by National Academy of Sciences, , U.S. charges against Thalha Jubair (computer fraud, wire fraud, money laundering), Potential extradition from U.K., Up to 95 years in prison if convicted, .

Lessons Learned and Recommendations

What lessons were learned from each incident ?

Incident : Cyber Espionage ADM740081425

Lessons Learned: Legacy systems (e.g., Windows XP-era software) in critical infrastructure pose severe risks., Nation-state actors exploit long-standing vulnerabilities for espionage and sabotage., Industrial control systems (e.g., dams) are targets for demonstrative attacks., Decentralized systems (e.g., 200+ local CM/ECF instances) complicate security., Pro-Russian cyber activity is escalating in both stealth (US) and spectacle (Norway).

Incident : Data Breach ADM758081525

Lessons Learned: Failure to patch known vulnerabilities leads to repeated breaches., Federal systems require **real-time logging and forensic capabilities** to reconstruct attacks., Transparency gaps undermine public trust in judicial cybersecurity., State-sponsored threats demand **proactive threat hunting** in critical infrastructure.

Incident : Cyber Espionage ADM831081625

Lessons Learned: Reactive 'education-by-breach' approach is insufficient for modern threats., Democratization of hacking tools lowers the barrier for sophisticated attacks., Diverse threat actors (nation-states, cartels, criminals) require a unified defense strategy., Centralized incident response and shared case studies could improve federal cybersecurity posture., Offensive cyber operations alone cannot mitigate systemic vulnerabilities.

Incident : data breach ADM742082525

Lessons Learned: Delayed adoption of phishing-resistant MFA creates critical vulnerabilities., Lack of transparency with Congress/public exacerbates reputational damage., Independent oversight may be necessary for federal judiciary cybersecurity., Unpatched vulnerabilities (even years old) remain high-risk targets.

Incident : Cyber Extortion ADM4102141092025

Lessons Learned: Helpdesk authentication processes are critical targets for social engineering attacks., Multi-factor authentication (MFA) is essential for administrative accounts., Cryptocurrency transactions can be traced to identify threat actors., Telegram and gaming platforms can serve as evidence sources in investigations., Collaboration between international law enforcement agencies is vital for disrupting cybercriminal networks.

What recommendations were made to prevent future incidents ?

Incident : Cyberattack, Data Breach ADM806080825

Recommendations: Replace PACER with a more cyber-secure system

Incident : Cyber Espionage ADM740081425

Recommendations: Immediate patching of legacy systems in judicial and critical infrastructure sectors., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., International cooperation on attributing and deterring state-sponsored cyber operations., Public-private partnerships to share threat intelligence on Kremlin-aligned actors.Immediate patching of legacy systems in judicial and critical infrastructure sectors., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., International cooperation on attributing and deterring state-sponsored cyber operations., Public-private partnerships to share threat intelligence on Kremlin-aligned actors.Immediate patching of legacy systems in judicial and critical infrastructure sectors., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., International cooperation on attributing and deterring state-sponsored cyber operations., Public-private partnerships to share threat intelligence on Kremlin-aligned actors.Immediate patching of legacy systems in judicial and critical infrastructure sectors., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., International cooperation on attributing and deterring state-sponsored cyber operations., Public-private partnerships to share threat intelligence on Kremlin-aligned actors.Immediate patching of legacy systems in judicial and critical infrastructure sectors., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., International cooperation on attributing and deterring state-sponsored cyber operations., Public-private partnerships to share threat intelligence on Kremlin-aligned actors.Immediate patching of legacy systems in judicial and critical infrastructure sectors., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., International cooperation on attributing and deterring state-sponsored cyber operations., Public-private partnerships to share threat intelligence on Kremlin-aligned actors.

Incident : Data Breach ADM758081525

Recommendations: Immediate patching of all known vulnerabilities in CM/ECF., Implementation of **zero-trust architecture** for federal judicial systems., Mandatory **third-party audits** of court IT infrastructure., Enhanced **insider threat monitoring** for sensitive case files., Public disclosure protocols to improve transparency post-breach.Immediate patching of all known vulnerabilities in CM/ECF., Implementation of **zero-trust architecture** for federal judicial systems., Mandatory **third-party audits** of court IT infrastructure., Enhanced **insider threat monitoring** for sensitive case files., Public disclosure protocols to improve transparency post-breach.Immediate patching of all known vulnerabilities in CM/ECF., Implementation of **zero-trust architecture** for federal judicial systems., Mandatory **third-party audits** of court IT infrastructure., Enhanced **insider threat monitoring** for sensitive case files., Public disclosure protocols to improve transparency post-breach.Immediate patching of all known vulnerabilities in CM/ECF., Implementation of **zero-trust architecture** for federal judicial systems., Mandatory **third-party audits** of court IT infrastructure., Enhanced **insider threat monitoring** for sensitive case files., Public disclosure protocols to improve transparency post-breach.Immediate patching of all known vulnerabilities in CM/ECF., Implementation of **zero-trust architecture** for federal judicial systems., Mandatory **third-party audits** of court IT infrastructure., Enhanced **insider threat monitoring** for sensitive case files., Public disclosure protocols to improve transparency post-breach.

Incident : Cyber Espionage ADM831081625

Recommendations: Implement a 'coordinated security uplift' across federal agencies., Develop and share incident case studies to proactively address threats., Move beyond reactive measures to predictive, intelligence-driven cybersecurity., Enhance monitoring and detection capabilities for prolonged intrusions., Address the root causes of systemic vulnerabilities in federal IT infrastructure.Implement a 'coordinated security uplift' across federal agencies., Develop and share incident case studies to proactively address threats., Move beyond reactive measures to predictive, intelligence-driven cybersecurity., Enhance monitoring and detection capabilities for prolonged intrusions., Address the root causes of systemic vulnerabilities in federal IT infrastructure.Implement a 'coordinated security uplift' across federal agencies., Develop and share incident case studies to proactively address threats., Move beyond reactive measures to predictive, intelligence-driven cybersecurity., Enhance monitoring and detection capabilities for prolonged intrusions., Address the root causes of systemic vulnerabilities in federal IT infrastructure.Implement a 'coordinated security uplift' across federal agencies., Develop and share incident case studies to proactively address threats., Move beyond reactive measures to predictive, intelligence-driven cybersecurity., Enhance monitoring and detection capabilities for prolonged intrusions., Address the root causes of systemic vulnerabilities in federal IT infrastructure.Implement a 'coordinated security uplift' across federal agencies., Develop and share incident case studies to proactively address threats., Move beyond reactive measures to predictive, intelligence-driven cybersecurity., Enhance monitoring and detection capabilities for prolonged intrusions., Address the root causes of systemic vulnerabilities in federal IT infrastructure.

Incident : data breach ADM742082525

Recommendations: Mandate phishing-resistant multifactor authentication across all federal court systems., Conduct an independent cybersecurity audit (e.g., by National Academy of Sciences)., Implement mandatory cybersecurity requirements for the judiciary (currently voluntary)., Disclose details of the 2020 intrusion and other past breaches to restore accountability., Accelerate patch management for critical vulnerabilities in case management systems.Mandate phishing-resistant multifactor authentication across all federal court systems., Conduct an independent cybersecurity audit (e.g., by National Academy of Sciences)., Implement mandatory cybersecurity requirements for the judiciary (currently voluntary)., Disclose details of the 2020 intrusion and other past breaches to restore accountability., Accelerate patch management for critical vulnerabilities in case management systems.Mandate phishing-resistant multifactor authentication across all federal court systems., Conduct an independent cybersecurity audit (e.g., by National Academy of Sciences)., Implement mandatory cybersecurity requirements for the judiciary (currently voluntary)., Disclose details of the 2020 intrusion and other past breaches to restore accountability., Accelerate patch management for critical vulnerabilities in case management systems.Mandate phishing-resistant multifactor authentication across all federal court systems., Conduct an independent cybersecurity audit (e.g., by National Academy of Sciences)., Implement mandatory cybersecurity requirements for the judiciary (currently voluntary)., Disclose details of the 2020 intrusion and other past breaches to restore accountability., Accelerate patch management for critical vulnerabilities in case management systems.Mandate phishing-resistant multifactor authentication across all federal court systems., Conduct an independent cybersecurity audit (e.g., by National Academy of Sciences)., Implement mandatory cybersecurity requirements for the judiciary (currently voluntary)., Disclose details of the 2020 intrusion and other past breaches to restore accountability., Accelerate patch management for critical vulnerabilities in case management systems.

Incident : Cyber Extortion ADM4102141092025

Recommendations: Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Segment networks to limit lateral movement by attackers., Train employees on recognizing social engineering tactics, especially for helpdesk staff., Enhance logging and monitoring of critical systems to detect unauthorized access., Coordinate with law enforcement proactively to share threat intelligence., Conduct regular audits of third-party vendors and service providers for security vulnerabilities.

What are the key lessons learned from past incidents ?

Key Lessons Learned: The key lessons learned from past incidents are Legacy systems (e.g., Windows XP-era software) in critical infrastructure pose severe risks.,Nation-state actors exploit long-standing vulnerabilities for espionage and sabotage.,Industrial control systems (e.g., dams) are targets for demonstrative attacks.,Decentralized systems (e.g., 200+ local CM/ECF instances) complicate security.,Pro-Russian cyber activity is escalating in both stealth (US) and spectacle (Norway).Failure to patch known vulnerabilities leads to repeated breaches.,Federal systems require **real-time logging and forensic capabilities** to reconstruct attacks.,Transparency gaps undermine public trust in judicial cybersecurity.,State-sponsored threats demand **proactive threat hunting** in critical infrastructure.Reactive 'education-by-breach' approach is insufficient for modern threats.,Democratization of hacking tools lowers the barrier for sophisticated attacks.,Diverse threat actors (nation-states, cartels, criminals) require a unified defense strategy.,Centralized incident response and shared case studies could improve federal cybersecurity posture.,Offensive cyber operations alone cannot mitigate systemic vulnerabilities.Delayed adoption of phishing-resistant MFA creates critical vulnerabilities.,Lack of transparency with Congress/public exacerbates reputational damage.,Independent oversight may be necessary for federal judiciary cybersecurity.,Unpatched vulnerabilities (even years old) remain high-risk targets.Helpdesk authentication processes are critical targets for social engineering attacks.,Multi-factor authentication (MFA) is essential for administrative accounts.,Cryptocurrency transactions can be traced to identify threat actors.,Telegram and gaming platforms can serve as evidence sources in investigations.,Collaboration between international law enforcement agencies is vital for disrupting cybercriminal networks.

What recommendations has the company implemented to improve cybersecurity ?

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Enhanced **insider threat monitoring** for sensitive case files., Public disclosure protocols to improve transparency post-breach., Immediate patching of all known vulnerabilities in CM/ECF., Mandatory **third-party audits** of court IT infrastructure. and Implementation of **zero-trust architecture** for federal judicial systems..

References

Where can I find more information about each incident ?

Incident : Data Breach ADM413080825

Source: Politico

Date Accessed: 2024-08-06

Incident : Cyberattack ADM805080825

Source: Politico

Incident : Cyberattack ADM805080825

Source: BleepingComputer

Incident : Cyberattack, Data Breach ADM806080825

Source: Politico

Incident : Cyber Espionage ADM740081425

Source: The Register

URL: https://www.theregister.com

Incident : Cyber Espionage ADM740081425

Source: New York Times

URL: https://www.nytimes.com

Incident : Cyber Espionage ADM740081425

Source: Norwegian PST (via local media)

Incident : Data Breach ADM758081525

Source: Politico

URL: https://www.politico.com/news/2024/08/06/federal-courts-hack-russia-00172345

Date Accessed: 2024-08-07

Incident : Data Breach ADM758081525

Source: The New York Times

URL: https://www.nytimes.com/2024/08/06/us/politics/federal-courts-hack-russia.html

Date Accessed: 2024-08-07

Incident : Data Breach ADM758081525

Source: Hunter Strategy (Jake Williams, former NSA hacker)

Date Accessed: 2024-08-07

Incident : Cyber Espionage ADM831081625

Source: Lawfare

URL: https://www.lawfareblog.com/drug-cartels-are-new-apts

Incident : data breach ADM742082525

Source: Sen. Ron Wyden's letter to Chief Justice John Roberts

Date Accessed: 2024-08-19

Incident : data breach ADM742082525

Source: Administrative Office of the U.S. Courts public statement

Date Accessed: 2024-08-07

Incident : data breach ADM742082525

Source: 2020 House Judiciary Chair Jerrold Nadler disclosure (referenced by Wyden)

Incident : Cyber Extortion ADM4102141092025

Source: U.S. Department of Justice

Date Accessed: 2024-07-18

Incident : Cyber Extortion ADM4102141092025

Source: FBI Statement (Brett Leatherman)

Date Accessed: 2024-07-18

Incident : Cyber Extortion ADM4102141092025

Source: Westminster Magistrates Court Records (Thalha Jubair and Owen Flowers)

Date Accessed: 2024-07-18

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: PoliticoDate Accessed: 2024-08-06, and Source: Politico, and Source: BleepingComputer, and Source: Politico, and Source: The RegisterUrl: https://www.theregister.com, and Source: New York TimesUrl: https://www.nytimes.com, and Source: Norwegian PST (via local media), and Source: PoliticoUrl: https://www.politico.com/news/2024/08/06/federal-courts-hack-russia-00172345Date Accessed: 2024-08-07, and Source: The New York TimesUrl: https://www.nytimes.com/2024/08/06/us/politics/federal-courts-hack-russia.htmlDate Accessed: 2024-08-07, and Source: Hunter Strategy (Jake Williams, former NSA hacker)Date Accessed: 2024-08-07, and Source: LawfareUrl: https://www.lawfareblog.com/drug-cartels-are-new-apts, and Source: Sen. Ron Wyden's letter to Chief Justice John RobertsDate Accessed: 2024-08-19, and Source: Administrative Office of the U.S. Courts public statementDate Accessed: 2024-08-07, and Source: 2020 House Judiciary Chair Jerrold Nadler disclosure (referenced by Wyden), and Source: U.S. Department of JusticeDate Accessed: 2024-07-18, and Source: FBI Statement (Brett Leatherman)Date Accessed: 2024-07-18, and Source: Westminster Magistrates Court Records (Thalha Jubair and Owen Flowers)Date Accessed: 2024-07-18.

Investigation Status

What is the current status of the investigation for each incident ?

Incident : Data Breach ADM413080825

Investigation Status: Ongoing

Incident : Cyberattack ADM805080825

Investigation Status: Ongoing

Incident : Cyber Espionage ADM740081425

Investigation Status: ['Ongoing (US Department of Justice)', 'Active (Norwegian PST)']

Incident : Data Breach ADM758081525

Investigation Status: Ongoing (as of August 2024; no official findings released)

Incident : Cyber Espionage ADM831081625

Investigation Status: ['Ongoing (implied by article’s call for improved response)', 'Likely classified details due to national security implications']

Incident : data breach ADM742082525

Investigation Status: Ongoing (Sen. Wyden demands independent review; judiciary response vague)

Incident : Cyber Extortion ADM4102141092025

Investigation Status: Ongoing (Jubair arrested; extradition efforts pending; additional co-conspirators under investigation)

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Informed The Impacted Members About The Breach, Published statement, Public Disclosure By Us Courts (August 5), Statements By Norwegian Pst (Via Local Media), Limited Public Disclosures (Via Media Leaks), No Official Federal Statement As Of August 2024, Public Disclosure Via Analysis (Lawfare Article), Likely Internal Federal Briefings, Public Statement On 2024-08-07 (Limited Details), No Response To 2020 Intrusion Disclosure, Doj Complaint Unsealing, Public Statements By Fbi/Doj Officials and Media Coverage Of Arrests.

Stakeholder and Customer Advisories

Were there any advisories issued to stakeholders or customers for each incident ?

Incident : Cyber Espionage ADM740081425

Stakeholder Advisories: Us Legal Community Warned Of Potential Compromise Of Sealed Cases., Norwegian Critical Infrastructure Operators Advised To Audit Control Systems..

Customer Advisories: Lawyers using CM/ECF/PACER advised to monitor for unusual activity.Norwegian public reassured that dam attack caused no lasting damage but demonstrated vulnerability.

Incident : Data Breach ADM758081525

Stakeholder Advisories: Judicial Conference Of The United States (Internal), Department Of Justice (Likely Involved).

Customer Advisories: None publicly issued to affected individuals (e.g., informants/witnesses)

Incident : Cyber Espionage ADM831081625

Stakeholder Advisories: Federal Judiciary Branches, U.S. Department Of Justice, Congressional Oversight Committees, Law Enforcement Agencies Involved In Affected Cases.

Customer Advisories: Legal professionals using CM/ECF and PACERWitnesses and individuals involved in compromised cases

Incident : Cyber Extortion ADM4102141092025

Stakeholder Advisories: Doj And Fbi Warnings About Scattered Spider Tactics, Advisories To Critical Infrastructure Sectors.

What advisories does the company provide to stakeholders and customers following an incident ?

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Us Legal Community Warned Of Potential Compromise Of Sealed Cases., Norwegian Critical Infrastructure Operators Advised To Audit Control Systems., Lawyers Using Cm/Ecf/Pacer Advised To Monitor For Unusual Activity., Norwegian Public Reassured That Dam Attack Caused No Lasting Damage But Demonstrated Vulnerability., , Judicial Conference Of The United States (Internal), Department Of Justice (Likely Involved), None Publicly Issued To Affected Individuals (E.G., Informants/Witnesses), , Federal Judiciary Branches, U.S. Department Of Justice, Congressional Oversight Committees, Law Enforcement Agencies Involved In Affected Cases, Legal Professionals Using Cm/Ecf And Pacer, Witnesses And Individuals Involved In Compromised Cases, , Doj And Fbi Warnings About Scattered Spider Tactics and Advisories To Critical Infrastructure Sectors.

Initial Access Broker

How did the initial access broker gain entry for each incident ?

Incident : Data Breach ADM413080825

High Value Targets: Confidential court documents

Data Sold on Dark Web: Confidential court documents

Incident : Cyber Espionage ADM740081425

Entry Point: Exploited Vulnerabilities In Cm/Ecf System (Us), Compromised Dam Control System Credentials/Access (Norway),

Reconnaissance Period: ['Years-long (US court system)', "Unspecified (Norway, but part of a 'change in activity over the past year')"]

High Value Targets: Sealed Indictments (Us), Witness Identities (Us), Dam Control Mechanisms (Norway),

Data Sold on Dark Web: Sealed Indictments (Us), Witness Identities (Us), Dam Control Mechanisms (Norway),

Incident : Data Breach ADM758081525

Entry Point: Exploited unpatched vulnerabilities in CM/ECF system (2019-era flaws)

Reconnaissance Period: Unknown (potentially years, given 2020 breach history)

High Value Targets: Sealed Indictments, Confidential Informant Databases, Ongoing Criminal Investigations,

Data Sold on Dark Web: Sealed Indictments, Confidential Informant Databases, Ongoing Criminal Investigations,

Incident : Cyber Espionage ADM831081625

Reconnaissance Period: ['Potentially extended (some actors maintained access for prolonged periods)']

Backdoors Established: ['Likely (given prolonged access by multiple actors)']

High Value Targets: Witness Data, Ongoing Criminal Investigations, Judicial Proceedings Involving Sensitive Cases,

Data Sold on Dark Web: Witness Data, Ongoing Criminal Investigations, Judicial Proceedings Involving Sensitive Cases,

Incident : data breach ADM742082525

Entry Point: Unpatched Vulnerabilities In Case Management System,

Reconnaissance Period: Potentially years (hackers may have 'lurked in systems for years')

High Value Targets: Sealed Criminal Cases, National Security Documents,

Data Sold on Dark Web: Sealed Criminal Cases, National Security Documents,

Incident : Cyber Extortion ADM4102141092025

Entry Point: Helpdesk password reset requests

Reconnaissance Period: Ongoing since at least May 2022

Backdoors Established: Yes (compromised administrative accounts)

High Value Targets: Federal Court Personnel Data, Subpoenas, Financial Services Customer Data,

Data Sold on Dark Web: Federal Court Personnel Data, Subpoenas, Financial Services Customer Data,

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : Data Breach ADM413080825

Corrective Actions: Implementing secure stand-alone computer systems for sensitive documents

Incident : Cyberattack ADM805080825

Corrective Actions: Strengthening cybersecurity measures

Incident : Cyber Espionage ADM740081425

Root Causes: Outdated And Unpatched Software (Us Court Systems)., Lack Of Segmentation In Critical Infrastructure Networks (Norway)., Insufficient Monitoring Of Anomalous Access Patterns (Both Incidents)., Geopolitical Tensions Enabling State-Sponsored Cyber Operations.,

Incident : Data Breach ADM758081525

Root Causes: Failure To Remediate Known Vulnerabilities (Since 2019)., Insufficient Logging For Attack Reconstruction., Lack Of **Defense-In-Depth** Strategies For Critical Judicial Systems., Potential **Supply Chain Risks** In Cm/Ecf Software.,

Corrective Actions: Emergency Vulnerability Assessments Across All Federal Court Systems., Deployment Of **Endpoint Detection And Response (Edr)** Tools., Reevaluation Of **Third-Party Vendor Security** For Cm/Ecf., Development Of A **Federal Judicial Cybersecurity Task Force**.,

Incident : Cyber Espionage ADM831081625

Root Causes: Systemic Vulnerabilities In Federal Cybersecurity Infrastructure, Lack Of Centralized Incident Response Coordination, Insufficient Proactive Threat Detection, Over-Reliance On Reactive Measures ('Education-By-Breach'), Underestimation Of Non-State Actors (E.G., Drug Cartels) As Cyber Threats,

Corrective Actions: Proposed 'Coordinated Security Uplift' For Federal Agencies, Development Of Shared Incident Case Studies, Enhanced Monitoring For Prolonged Intrusions, Reevaluation Of Offensive Cyber Operations’ Role In Defense, Improved Collaboration Between Judicial, Law Enforcement, And Intelligence Agencies,

Incident : data breach ADM742082525

Root Causes: Failure To Patch Known Vulnerabilities For ~5 Years., Inadequate Multifactor Authentication (Non-Phishing-Resistant)., Lack Of Mandatory Cybersecurity Requirements For The Judiciary., Culture Of Secrecy/Cover-Up (E.G., Undisclosed 2020 Breach)., Slow Response To Escalating Threats (E.G., 2020 And 2024 Intrusions By Same Actors).,

Incident : Cyber Extortion ADM4102141092025

Root Causes: Inadequate Authentication For Helpdesk Password Resets, Lack Of Mfa For Administrative Accounts, Insufficient Monitoring Of Privileged Account Activity, Human Error (Falling For Social Engineering),

Corrective Actions: Doj/Fbi Disruption Of Scattered Spider Operations (Server Seizures, Arrests), Heightened Scrutiny Of Helpdesk Processes In Federal Agencies, International Law Enforcement Collaboration To Track Cryptocurrency And Threat Actors,

What is the company's process for conducting post-incident analysis ?

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Likely (but not detailed publicly), Recommended As Part Of Proposed 'Coordinated Security Uplift', , Collaboration With Congress, Federal Agencies (Unspecified), , U.K. National Crime Agency, West Midlands Police, City Of London Police, Agencies In Canada, Romania, Australia, And The Netherlands, .

What corrective actions has the company taken based on post-incident analysis ?

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Implementing secure stand-alone computer systems for sensitive documents, Strengthening cybersecurity measures, Emergency Vulnerability Assessments Across All Federal Court Systems., Deployment Of **Endpoint Detection And Response (Edr)** Tools., Reevaluation Of **Third-Party Vendor Security** For Cm/Ecf., Development Of A **Federal Judicial Cybersecurity Task Force**., , Proposed 'Coordinated Security Uplift' For Federal Agencies, Development Of Shared Incident Case Studies, Enhanced Monitoring For Prolonged Intrusions, Reevaluation Of Offensive Cyber Operations’ Role In Defense, Improved Collaboration Between Judicial, Law Enforcement, And Intelligence Agencies, , Doj/Fbi Disruption Of Scattered Spider Operations (Server Seizures, Arrests), Heightened Scrutiny Of Helpdesk Processes In Federal Agencies, International Law Enforcement Collaboration To Track Cryptocurrency And Threat Actors, .

Additional Questions

General Information

Has the company ever paid ransoms ?

Ransom Payment History: The company has Paid ransoms in the past.

What was the amount of the last ransom demanded ?

Last Ransom Demanded: The amount of the last ransom demanded was ['$25 million (one victim)', '$36.2 million (another victim)', 'Total: $115 million across all victims'].

Who was the attacking group in the last incident ?

Last Attacking Group: The attacking group in the last incident were an Nation-state actors (suspected), Russian State-Sponsored Actors (suspected)Kremlin-Aligned Cyber Groups, Allegedly linked to Russia (unconfirmed)State-sponsored actors (suspected), Latin American Drug Cartels (potential weaponization of data)Multiple Nation-StatesVarious Criminal Groups, Alleged Russian hackers (same group linked to a prior 2020 intrusion), Scattered SpiderThalha Jubair (19, U.K. national)Owen Flowers (18 and U.K. national)Unnamed U.S.-based co-conspirator.

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2025-07-04.

What was the most recent incident publicly disclosed ?

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-07-18.

Impact of the Incidents

What was the highest financial loss from an incident ?

Highest Financial Loss: The highest financial loss from an incident was $115 million (ransom payments).

What was the most significant data compromised in an incident ?

Most Significant Data Compromised: The most significant data compromised in an incident were financial information, trade secrets, sales figures, contracts, product plans, , Confidential court documents, identities of confidential informants, sensitive case documents, identities of confidential informants, , sensitive documents, potential exposure of confidential informant identities, , Sealed court documents, Witness identities, US court system blueprints, Midlevel criminal case files (NYC and other jurisdictions), , Sealed court records, Confidential informant identities, Cooperating witness identities, Criminal dockets, Arrest warrants, Sealed indictments, , Witness identities, Details of ongoing criminal investigations, Sensitive unclassified judicial records, , sealed case data, potential national security documents, criminal charging/investigative documents, , Personnel data (names, usernames, telephone numbers), Federal judge subpoenas, Thousands of names, titles, and work locations of U.S. Courts users, Customer account information (requested via financial services provider) and .

What was the most significant system affected in an incident ?

Most Significant System Affected: The most significant system affected in an incident were CM/ECFPACER and Public Access to Court Electronic Records (PACER) and US Courts' CM/ECF (Case Management/Electronic Case Files) systemPACER (Public Access to Court Electronic Records)Bremanger Dam Control Systems (Norway) and Case Management/Electronic Case Files (CM/ECF) systemBackup paper-filing systems (activated as contingency) and Case Management/Electronic Case Files (CM/ECF)Public Access to Court Electronic Records (PACER) and federal district court case management system and U.S. Federal Court NetworkSeven victim companies (unnamed)Transport for London (2023)47 U.S. entitiesCompanies in insurance, retail, and aviation industries.

Response to the Incidents

What third-party assistance was involved in the most recent incident ?

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was collaboration with congress, federal agencies (unspecified), , u.k. national crime agency, west midlands police, city of london police, agencies in canada, romania, australia, and the netherlands, .

What containment measures were taken in the most recent incident ?

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were secured its networks, Restricting access to sensitive documents, Stricter access controls, Isolation of affected CM/ECF componentsTransition to manual filings and Seizure of servers and cryptocurrency wallets ($36M)Shutdown of Scattered Spider's Telegram channel.

Data Breach Information

What was the most sensitive data compromised in a breach ?

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were contracts, Witness identities, Sealed indictments, Details of ongoing criminal investigations, potential national security documents, Criminal dockets, Confidential informant identities, Confidential court documents, identities of confidential informants, Sensitive unclassified judicial records, criminal charging/investigative documents, Customer account information (requested via financial services provider), identities of confidential informants, product plans, US court system blueprints, sealed case data, financial information, Midlevel criminal case files (NYC and other jurisdictions), Cooperating witness identities, potential exposure of confidential informant identities, trade secrets, sensitive documents, sensitive case documents, Thousands of names, titles, and work locations of U.S. Courts users, Personnel data (names, usernames, telephone numbers), Sealed court records, Federal judge subpoenas, sales figures, Arrest warrants and Sealed court documents.

What was the number of records exposed in the most significant breach ?

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 0.

Ransomware Information

What was the highest ransom demanded in a ransomware incident ?

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was ['$25 million (one victim)', '$36.2 million (another victim)', 'Total: $115 million across all victims'].

What was the highest ransom paid in a ransomware incident ?

Highest Ransom Paid: The highest ransom paid in a ransomware incident was $115 million (total across all victims).

Regulatory Compliance

What was the most significant legal action taken for a regulatory violation ?

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential congressional hearings, Internal judicial reviews, , Sen. Wyden's call for independent review by National Academy of Sciences, , U.S. charges against Thalha Jubair (computer fraud, wire fraud, money laundering), Potential extradition from U.K., Up to 95 years in prison if convicted, .

Lessons Learned and Recommendations

What was the most significant lesson learned from past incidents ?

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Collaboration between international law enforcement agencies is vital for disrupting cybercriminal networks.

What was the most significant recommendation implemented to improve cybersecurity ?

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Train employees on recognizing social engineering tactics, especially for helpdesk staff., Segment networks to limit lateral movement by attackers., Implement stricter identity verification for helpdesk password resets (e.g., MFA, challenge questions)., Mandatory multi-factor authentication for sensitive legal and infrastructure systems., Coordinate with law enforcement proactively to share threat intelligence., Enhanced **insider threat monitoring** for sensitive case files., Monitor administrative accounts for unusual activity (e.g., sudden data access or exfiltration)., Accelerate patch management for critical vulnerabilities in case management systems., Mandatory **third-party audits** of court IT infrastructure., Conduct regular audits of third-party vendors and service providers for security vulnerabilities., Move beyond reactive measures to predictive, intelligence-driven cybersecurity., Immediate patching of legacy systems in judicial and critical infrastructure sectors., Enhanced monitoring of industrial control systems for anomalous behavior (e.g., dam valve changes)., Consolidation of fragmented IT systems (e.g., US courts' local instances) to reduce attack surface., Conduct an independent cybersecurity audit (e.g., by National Academy of Sciences)., Implement mandatory cybersecurity requirements for the judiciary (currently voluntary)., Immediate patching of all known vulnerabilities in CM/ECF., International cooperation on attributing and deterring state-sponsored cyber operations., Address the root causes of systemic vulnerabilities in federal IT infrastructure., Public-private partnerships to share threat intelligence on Kremlin-aligned actors., Implementation of **zero-trust architecture** for federal judicial systems., Public disclosure protocols to improve transparency post-breach., Replace PACER with a more cyber-secure system, Develop and share incident case studies to proactively address threats., Enhance monitoring and detection capabilities for prolonged intrusions., Disclose details of the 2020 intrusion and other past breaches to restore accountability., Enhance logging and monitoring of critical systems to detect unauthorized access., Mandate phishing-resistant multifactor authentication across all federal court systems. and Implement a 'coordinated security uplift' across federal agencies..

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are FBI Statement (Brett Leatherman), Westminster Magistrates Court Records (Thalha Jubair and Owen Flowers), U.S. Department of Justice, The Register, Politico, Hunter Strategy (Jake Williams, former NSA hacker), BleepingComputer, Lawfare, Sen. Ron Wyden's letter to Chief Justice John Roberts, The New York Times, 2020 House Judiciary Chair Jerrold Nadler disclosure (referenced by Wyden), Norwegian PST (via local media), Administrative Office of the U.S. Courts public statement and New York Times.

What is the most recent URL for additional resources on cybersecurity best practices ?

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.theregister.com, https://www.nytimes.com, https://www.politico.com/news/2024/08/06/federal-courts-hack-russia-00172345, https://www.nytimes.com/2024/08/06/us/politics/federal-courts-hack-russia.html, https://www.lawfareblog.com/drug-cartels-are-new-apts .

Investigation Status

What is the current status of the most recent investigation ?

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Stakeholder and Customer Advisories

What was the most recent stakeholder advisory issued ?

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was US legal community warned of potential compromise of sealed cases., Norwegian critical infrastructure operators advised to audit control systems., Judicial Conference of the United States (internal), Department of Justice (likely involved), Federal judiciary branches, U.S. Department of Justice, Congressional oversight committees, Law enforcement agencies involved in affected cases, DOJ and FBI warnings about Scattered Spider tactics, Advisories to critical infrastructure sectors, .

What was the most recent customer advisory issued ?

Most Recent Customer Advisory: The most recent customer advisory issued were an Lawyers using CM/ECF/PACER advised to monitor for unusual activity.Norwegian public reassured that dam attack caused no lasting damage but demonstrated vulnerability., None publicly issued to affected individuals (e.g., informants/witnesses) and Legal professionals using CM/ECF and PACERWitnesses and individuals involved in compromised cases.

Initial Access Broker

What was the most recent entry point used by an initial access broker ?

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Exploited unpatched vulnerabilities in CM/ECF system (2019-era flaws) and Helpdesk password reset requests.

What was the most recent reconnaissance period for an incident ?

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Years-long (US court system)Unspecified (Norway, but part of a 'change in activity over the past year'), Unknown (potentially years, given 2020 breach history), Potentially extended (some actors maintained access for prolonged periods), Potentially years (hackers may have 'lurked in systems for years'), Ongoing since at least May 2022.

Post-Incident Analysis

What was the most significant root cause identified in post-incident analysis ?

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Outdated and unpatched software (US court systems).Lack of segmentation in critical infrastructure networks (Norway).Insufficient monitoring of anomalous access patterns (both incidents).Geopolitical tensions enabling state-sponsored cyber operations., Failure to remediate known vulnerabilities (since 2019).Insufficient logging for attack reconstruction.Lack of **defense-in-depth** strategies for critical judicial systems.Potential **supply chain risks** in CM/ECF software., Systemic vulnerabilities in federal cybersecurity infrastructureLack of centralized incident response coordinationInsufficient proactive threat detectionOver-reliance on reactive measures ('education-by-breach')Underestimation of non-state actors (e.g., drug cartels) as cyber threats, Failure to patch known vulnerabilities for ~5 years.Inadequate multifactor authentication (non-phishing-resistant).Lack of mandatory cybersecurity requirements for the judiciary.Culture of secrecy/cover-up (e.g., undisclosed 2020 breach).Slow response to escalating threats (e.g., 2020 and 2024 intrusions by same actors)., Inadequate authentication for helpdesk password resetsLack of MFA for administrative accountsInsufficient monitoring of privileged account activityHuman error (falling for social engineering).

What was the most significant corrective action taken based on post-incident analysis ?

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Implementing secure stand-alone computer systems for sensitive documents, Strengthening cybersecurity measures, Emergency vulnerability assessments across all federal court systems.Deployment of **endpoint detection and response (EDR)** tools.Reevaluation of **third-party vendor security** for CM/ECF.Development of a **federal judicial cybersecurity task force**., Proposed 'coordinated security uplift' for federal agenciesDevelopment of shared incident case studiesEnhanced monitoring for prolonged intrusionsReevaluation of offensive cyber operations’ role in defenseImproved collaboration between judicial, law enforcement, and intelligence agencies, DOJ/FBI disruption of Scattered Spider operations (server seizures, arrests)Heightened scrutiny of helpdesk processes in federal agenciesInternational law enforcement collaboration to track cryptocurrency and threat actors.

Latest Global CVEs (Not Company-Specific)

Description

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Published

Date

2025-12-07

Updated

Date

2025-12-07

Risk Information

cvss2

Base: 6.5

Severity: LOW

AV:N/AC:L/Au:S/C:P/I:P/A:P

cvss3

Base: 6.3

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

cvss4

Base: 5.3

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Description

A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This manipulation of the argument subid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Published

Date

2025-12-07

Updated

Date

2025-12-07

Risk Information

cvss2

Base: 6.5

Severity: LOW

AV:N/AC:L/Au:S/C:P/I:P/A:P

cvss3

Base: 6.3

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

cvss4

Base: 5.3

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Description

A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnerability is an unknown functionality of the file /dishsub.php. The manipulation of the argument item.name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

Published

Date

2025-12-07

Updated

Date

2025-12-07

Risk Information

cvss2

Base: 3.3

Severity: LOW

AV:N/AC:L/Au:M/C:N/I:P/A:N

cvss3

Base: 2.4

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

cvss4

Base: 4.8

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Description

A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected is an unknown function of the file /usersub.php of the component Request Pending Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Published

Date

2025-12-07

Updated

Date

2025-12-07

Risk Information

cvss2

Base: 4.0

Severity: LOW

AV:N/AC:L/Au:S/C:N/I:P/A:N

cvss3

Base: 3.5

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

cvss4

Base: 5.1

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Description

A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published

Date

2025-12-07

Updated

Date

2025-12-07

Risk Information

cvss2

Base: 6.5

Severity: LOW

AV:N/AC:L/Au:S/C:P/I:P/A:P

cvss3

Base: 6.3

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

cvss4

Base: 5.3

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=fd-oregon' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation

Rapid

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest reports → View all security reports →

Badge your company to reduce your risk score and your cyber insurance costs!

Badge your company to reduce your risk score and your cyber insurance costs!

Federal Public Defender, District of Oregon Company CyberSecurity Posture

Federal Public Defender, District of Oregon A.I CyberSecurity Scoring

FPDDO Company CyberSecurity News & History

Attack that could injure or kill people

Attack threatening the organization’s existence

Attack threatening the organization's existence

Attack threatening the organization's existence

Attack threatening the organization’s existence

Attack threatening the organization's existence

Attack threatening the organization's existence

Attack threatening the organization's existence

Attack threatening the economy of a geographical region

United States Federal Judiciary (CM/ECF System)

U.S. Federal Judiciary (CM/ECF and PACER systems)

U.S. Federal Courts

Administrative Office of the United States Courts (AOUSC)

Administrative Office of the U.S. Courts (Federal Judiciary)

U.S. Federal Judiciary

United States Courts (Federal Court Network)

Administrative Office of the United States Courts (AOUSC)

United States Courts

FPDDO Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

A.I Risk Score Likelihood 3 - 6 - 9 months

Underwriter Stats for FPDDO

Incidents vs Administration of Justice Industry Average (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types FPDDO vs Administration of Justice Industry Avg (This Year)

Incident History — FPDDO (X = Date, Y = Severity)

FPDDO Company Subsidiaries

Federal Public Defender, District of OregonLast updated: N/A

Federal Public Defender, District of Oregon

FPDDO Similar Companies

East Baton Rouge Parish Juvenile Court

Tribunal Regional Federal da Primeira Região

TSJ, Tribunal Supremo de Justicia

Florida Office of State Courts Administrator

Louisiana Supreme Court

Arizona Supreme Court

FPDDO CyberSecurity News

States Struggle to Fill K-12 Cybersecurity Gaps Left by Federal Cuts

Ransomware surge: Sensata Technologies, US state agencies targeted in widespread cyber incidents

Oregon’s environmental agency shuts down network after cyberattack

Federal Executive Forum Cybersecurity for Defense and Homeland Progress and Best Practices 2025

Biden nominates 2 US Navy Reserve officers to federal appeals courts

‘It’s broken’ | Judges dismissing cases because no public defenders are available

Frequently Asked Questions

FPDDO CyberSecurity History Information

Official Website of Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon’s AI-Generated Cybersecurity Score

How many security badges does Federal Public Defender, District of Oregon’ have ?

Does Federal Public Defender, District of Oregon have SOC 2 Type 1 certification ?

Does Federal Public Defender, District of Oregon have SOC 2 Type 2 certification ?

Does Federal Public Defender, District of Oregon comply with GDPR ?

Does Federal Public Defender, District of Oregon have PCI DSS certification ?

Does Federal Public Defender, District of Oregon comply with HIPAA ?

Does Federal Public Defender, District of Oregon have ISO 27001 certification ?

Industry Classification of Federal Public Defender, District of Oregon

Number of Employees at Federal Public Defender, District of Oregon

Subsidiaries Owned by Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon’s LinkedIn Followers

NAICS Classification of Federal Public Defender, District of Oregon

Federal Public Defender, District of Oregon’s Presence on Crunchbase

Federal Public Defender, District of Oregon’s Presence on LinkedIn

Cybersecurity Incidents Involving Federal Public Defender, District of Oregon

Number of Peer and Competitor Companies

What types of cybersecurity incidents have occurred at Federal Public Defender, District of Oregon ?

What was the total financial impact of these incidents on Federal Public Defender, District of Oregon ?

How does Federal Public Defender, District of Oregon detect and respond to cybersecurity incidents ?

Incident Details

Can you provide details on each incident ?

Incident : Data Breach

Incident : Data Breach

Incident : Cyberattack

Incident : Cyberattack, Data Breach

Incident : Cyber Espionage

Incident : Data Breach

Incident : Cyber Espionage