The fact that the UN had fallen victim to a hacking attack and no one had known about it was surprising .
Every day we hear about hacking incidents and data breaches in companies, businesses and organizations. When something like this happens, those responsible must make the incident. The main reason is that all those involved (e.g. customers, partners, etc.) have the right to be informed, so that they can take appropriate protection.
But what happens when someone keeps a hack? And, most importantly, what happens when a major organization tries to keep such a secret?
Something like this happened with the United Nations (UN). It is said that some hackers breached the organization's databases and servers .
The incident was reported by “The New Humanitarian”, which conducted an investigation and uncovered details about the violation incident.
The company discovered a confidential report about the UN, which reveals that in August 2019, IT officials at the United Nations offices in Geneva warned of a hacking attack.
"We are working under the belief that the entire domain is compromised. The attacker is showing no signs of activity so far, we assume he has 'established his position' and is currently inactive," IT officials in the alert.
Experts detected the hack in August. However, it was later discovered that the breach had taken place in July 2019.
According to the data, a total of 33 UN servers . Some of them were related to the organization's human rights offices and human resources department. Some administrator accounts were also compromised.
The bad thing is that the UN tried to keep it a secret. It didn't make any announcement. But the worst thing is that it didn't even inform the staff about the breach. It simply asked them to change their passwords.
On top of all this, there is an even bigger problem. According to the data, the hackers managed to gain access by exploiting a known vulnerability in Microsoft Sharepoint (CVE-2019-0604). Microsoft had issued patches to fix the vulnerability in both February and April 2019. This means that the UN had not updated its systems, leaving millions of critical data vulnerable.
You can read The New Humanitarian's full report on the breach of UN systems here.
