Reporting a hack is the right thing to do for many reasons, most important of which is to inform folks so they can protect themselves.

But what if a hack happens and nobody is told?

That appears to be the case with the United Nations (UN) which allegedly experienced a massive breach in which its networks and databases were compromised.

This is according to an investigation conducted by The New Humanitarian which discovered details of the aforementioned hack.

The publication discovered a confidential report about the UN which reveals that in August 2019, IT officials at the UN’s offices in Geneva issued an alert about a hacking incident.

“We are working under the assumption that the entire domain is compromised. The attacker doesn’t show signs of activity so far, we assume they established their position and are dormant,” read the alert.

While the breach was detected in August, it was later discovered that the breach had taken place in July 2019.

As many as 33 UN servers including those at its human rights offices, and its human resources department were compromised as were some administrator accounts. The worst part is that staff at the UN were not informed of the breach and were simply asked to change their passwords.

Wait, did we say that was the worst part? We lied.

The Register reports that the hacker’s point of entry was a known flaw in Microsoft Sharepoint (CVE-2019-0604). Making matters worse for the UN is the fact that this flaw was patched by Microsoft in February 2019 with additional updates sent out in April 2019.

As The New Humanitarian points out, the UN’s diplomatic status means it is not obliged to report the hack thanks to its immunity from legal processes.

That having been said, with employee information compromised, the organisation should have reported the incident.

We recommend reading The New Humanitarian’s full report here and if you haven’t yet, make sure all your software is up to date and protected from miscreants online.

[Image – CC BY 2.0 sanjitbakshi]