An Iranian hack of the Navy's largest unclassified computer network reportedly took more than four months to resolve, raising concern among some lawmakers about security gaps exposed by the attack.
The Wall Street Journal, citing current and former U.S. officials, reported late Monday that the cyberattack targeted the Navy Marine Corps Internet, which is used by the Navy Department to host websites, store nonsensitive information, and handle voice, video, and data communications.
The paper reported that the hackers were able to remain in the network until this past November. That contradicts what officials told the Journal when the attack was first publicly reported this past September. At the time, officials told the paper that the intruders had been removed.
"It was a real big deal," a senior U.S. official told the Journal. "It was a significant penetration that showed a weakness in the system."
The quoted official said that the Iranians were able to conduct surveillance and compromise communications over the unclassified computer networks of the Navy and Marine Corps. However, another senior official told the Journal that no e-mail accounts were hacked and no data was stolen. There is also no evidence that Iran was able to penetrate classified U.S. computer networks.
The cyberattack is one of the one of the most serious infiltrations of government computer systems by the Iranians. The Journal reported that U.S. defense officials were surprised at the skill of the hackers, who were able to enter the network through a security gap in a public-facing website.
The military response to the hack was over seen by Vice Adm. Mike Rogers, President Obama's pick to be the next head the National Security Agency. Congressional aides told the Journal that Rogers would likely face questions on plans to fix security issues that have surfaced as a result of the attack. A confirmation hearing for Rogers has not yet been scheduled.
Despite the length of the operation to remove the hackers, officials who spoke to the Journal praised Rogers for his leadership of the cybersecurity response. The issue is not expected to prevent Rogers from being confirmed as NSA director.