HOW BAD IS THE HACK THAT TARGETED US AGENCIES?

Governments and major corporations worldwide are scrambling to see if they, too, were victims of a global cyberespionage campaign that penetrated multiple U.S. government agencies and involved a common software product used by thousands of organizations.

Russia, the prime suspect, denies involvement. Cybersecurity investigators said the hack’s impact extends far beyond the affected U.S. agencies, which include the Treasury and Commerce departments, though they haven’t disclosed which companies or what other governments were targeted.

WHAT HAPPENED?

The hack began as early as March when malicious code was snuck into updates to popular software that the monitors computer networks of businesses and governments. The malware, affecting a product made by U.S. company SolarWinds, gave elite hackers remote access into an organization’s networks so it could steal information. It wasn’t discovered until the prominent cybersecurity company FireEye learned it was hacked. Whoever broke into FireEye was seeking data on its government clients, the company said — and made offwith hacking tools it uses to probe its customers’ defenses.

“There’s no evidence that this was meant to be destructive,” said Ben Buchanan, Georgetown University cyberespionage expert and author of “The Hacker and The State.” He called the campaign’s scope, “impressive, surprising and alarming.” Globally, corporate and government IT cyberthreat teams scoured networks Monday in search of the hackers’ super-stealthy spyware.

Its apparent months-long timeline gave the hackers ample time to extract information from a lot of different targets. Buchanan said the impact is likely to be significant and compared its magnitude to the 2015 Chinese hack of the U.S. Office of Personnel Management, in which the records of 22 million federal employees and government job applicants were stolen.