UN spokesman Stephane Dujarric said Wednesday that the organization's offices in Geneva and Vienna were targeted in July 2019 by sophisticated cyberattacks.
"[The] attacks took place in the middle of last year," Dujarric told reporters on Wednesday. "The attribution of any attack remains very fuzzy and uncertain, so we are not able to pinpoint to any specific potential attacker, but it was from all accounts a well-resourced attack."
Earlier in the day, The New Humanitarian (TNH) reported that UN offices in Geneva and Vienna were infiltrated by hackers in 2019.
Dujarric reportedly confirmed to TNH that the attack took place, adding that it was “serious” but, due to an undetermined level of severity, was not revealed to employees at the time.
Dujarric said to TNH that resources had been directed towards strengthening key tech infrastructure at their offices.
“This included rebuilding significant elements of the infrastructure, and replacement of keys and credentials. Additional technical and procedural controls have been implemented to further strengthen information security for the affected offices. You can’t be a global governance body and not be accountable for holding yourself to a professional standard", he said.
The New Humanitarian said that 20 machines were entirely rebuilt and reported that IT staff at the organization were made to work overtime hours.
One employee described the hit as a “major meltdown.”
“We are working under the assumption that the entire domain is compromised. The attacker doesn't show signs of activity so far, we assume they established their position and are dormant", warned one agency-wide alert reportedly sent to employees.
Although the breach occurred in July 2019, United Nations employees were not informed until the end of August.
Dozens of servers, which included the human rights wing and human resources department, containing the private information of staff, were supposedly compromised.
The report claims that the UN did not initially reveal that the attack had taken place, and that staff were simply asked at the time of its first discovery to change passwords.