It is very unlikely that such a demand will be met. Nor is it clear how the access was obtained or whether there has been a ransom demand.

InvestigationĪccording to Drew Wade, spokesperson for the USMS: 'Shortly after that discovery, the USMS disconnected the affected system, and the Department of Justice initiated a forensic investigation.'įor now it is unclear which ransomware group is behind the attack. The USMS says the ransomware and data exfiltration event affected a single standalone USMS system.īut even though it wasn't connected to a larger federal network, the cyberattack was considered a major incident by officials. That's because the breached data contains law enforcement sensitive information pertaining to the subjects of Marshals Service investigations.įederal agencies are required to report major incidents to Congress within seven days of identification. The USMS says it is using a workaround to keep its investigations going. One of the tasks of the USMS is to assure the safety of endangered government witnesses and their families. Luckily, according to sources, the attackers didn't gain access to any data related to the witness protection program WITSEC.

Ransomware gangs threaten to disclose stolen data on so-called leak sites as extra leverage to get a victim to pay the ransom.

On February 17, 2023, the attacker infiltrated a system that held information about ongoing investigations, including personally identifiable information (PII) of fugitives, staff, and third parties.Īs with most ransomware attacks nowadays, the attacker also exfiltrated data before starting the encryption routine.

The US Marshals Service (USMS) says it's suffered a ransomware attack in which a threat actor managed to get hold of sensitive information about staff and fugitives.

Malwarebytes is malware