Biden Vows “Substantial Costs” for Those Responsible for SolarWinds Hack

U.S. President-Elect Joe Biden said he would impose “substantial costs” on the actors responsible for a massive cyber-espionage breach of U.S. government agencies and companies.

“A good defense isn’t enough; we need to disrupt and deter our adversaries from undertaking significant cyberattacks in the first place,” Biden said, according to The New York Times. “I will not stand idly by in the face of cyberassaults on our nation.”

Biden’s response comes after a week of turmoil for the national and cybersecurity communities after a vendor that provided software to the U.S. federal government, as well as numerous Fortune 500 companies and others, disclosed that it had been the victim of a targeted, nation-state attack. Malicious actors, said to be Russians, breached SolarWinds’ systems and used that access to then infiltrate its clients’ networks in a major cyber breach.

The U.S. Department of Homeland Security (DHS) also issued a notice that SolarWinds was not the only attack vector that hackers may have used to infiltrate U.S. government agencies. Dark Reading obtained a copy of the notice, issued by the Cybersecurity and Infrastructure Security Agency (CISA).

“CISA has evidence of additional initial access vectors, other than the SolarWinds Orion platform; however, these are still being investigated,” the agency said. “CISA will update this Alert as new information becomes available.”

The Trump administration has acknowledged the reports of the breach and confirmed that the threat actors were able to gain access to the U.S. Treasury Department and a section of the U.S. Department of Commerce.

“The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” National Security Council spokesman John Ullyot wrote in an emailed statement to CNBC.

In addition, Microsoft says it has identified more than 40 victims of the SolarWinds hack—80 percent of which were located in the United States.

“Microsoft President Brad Smith said his company is now in the process of notifying all the impacted organizations, 80 percent of which are located in the United States, with the rest being spread across seven other countries—namely Canada, Mexico, Belgium, Spain, the UK, Israel, and the UAE,” according to ZD Net.

“While the current list of known victims of the SolarWinds hack mostly includes U.S. government agencies, Smith said the government sector is only a small portion of the victim list, with 44 percent being IT companies, such as software firms and equipment providers.”