CISA CSAT Breach Update – 6-20-24

Earlier this afternoon, CISA provided an email to registered recipients providing the following updates to their CSAT Breach notification. This latest notification notes that:

“This announcement applies to all facilities registered with the CFATS program. Direct email notification is being made to individual facilities’ CSAT Authorizers and Cyber Security Officers, if designated, in batches; we anticipate that all registered Authorizers and Cyber Security Officers will receive this notification by Monday, June 24. If you have additional questions, please contact us at CFATS.Notifications@cisa.dhsg.gov or CFATS@hq.dhs.gov.”

The terminology “all facilities registered with the CFATS program” almost certainly means any facility that has registered a facility Authorizer in preparation for submitting a Top Screen, whether or not a Top Screen was ever submitted. It is certainly not limited to facilities that have been notified that they were a covered facility under the Chemical Facility Anti-Terrorism Standards (CFATS) program.

CISA Announces CSAT Breach

As if the CFATS program did not have enough problems, today CISA announced that there was a cybersecurity breach of their Chemical Security Assessment Tool (CSAT) in January of this year. The notice states that:

“While CISA’s investigation found no evidence of exfiltration of data, this intrusion may have resulted in the potential unauthorized access of Top-Screen surveys, Security Vulnerability Assessments, Site Security Plans, Personnel Surety Program (PSP) submissions, and CSAT user accounts.”

CISA has directly contacted individuals with CSAT accounts to notify them of the breach.

CISA has scheduled two webinars to discuss the breach, its potential consequences, and actions facilities should take as a consequence of the breach. Webinars will be held on June 24^th, 2024 and July 9^th, 2024 (links are to registration pages).

There is an interesting notification problem associated with this potential breach, there is a possibility that that individuals who had been vetted via the CFATS personnel surety tool may have had their data exposed during the breach. CISA does not have access to the contact information for these individuals so cannot make the necessary breach notifications. CISA thus notes that:

“CISA is thereby requesting, on a voluntary basis, that facilities that received the CSAT Ivanti Notification Letter notify individuals submitted by that facility for vetting under the CFATS Personnel Surety Program of this incident. Download a template letter that facilities can use to notify personnel. Alternatively, should facilities decline to notify these individuals, CISA requests that facilities provide CISA with the contact information for individuals submitted under the CFATS Personnel Surety Program on a voluntary basis so that CISA can notify impacted individuals. Facilities can send contact information for personnel that had Personally Identifiable Information (PII) submitted for vetting under CFATS Personnel Surety Program to CFATS.Notifications@cisa.dhs.gov.”

The announcement has a brief frequently asked question section that addresses the following questions:

• How was this compromise identified?

• What actions did CISA take to address the compromise?

• If CISA does not have any evidence of data exfiltration, why are notifications being sent?

• Where can I get more information on this cybersecurity incident?

• As a facility official, who do I contact if I have more questions about this incident?

• As a potentially impacted individual, who do I contact if I have more questions?

• Who is eligible for identity protection based on this compromise?

• How do I apply for identity protection?

• Why is identity protection not available to me?

• What data was collected in the CFATS Top-Screen survey?

• What data was collected in the Security Vulnerability Assessment (SVA)?

• What data was collected in the Site Security Plan/Alternative Security Program (SSP/ASP)?

• What data was collected in the Personnel Surety Program?