Leaked report shows United Nations suffered hack

Photo: The Canadian Press

UN High Commissioner for Human Rights Michelle Bachelet speaks an update on the situation of human rights in Venezuela, of the Human Rights Council, at the European headquarters of the United Nations in Geneva, Switzerland.

The United Nations has been hacked.

An internal confidential document from the United Nations, leaked to The New Humanitarian and seen by The Associated Press, says that dozens of servers were “compromised” at its offices in Geneva and Vienna.

Those include the U.N. human rights office, which has often been a lightning rod of criticism from autocratic governments for its calling-out of rights abuses.

One U.N. official told the AP that the hack, which was first detected over the summer, appeared “sophisticated” and that the extent of the damage remained unclear, especially in terms of personal, secret or compromising information that may have been stolen. The official, who spoke only on condition of anonymity to speak freely about the episode, said systems have since been reinforced.

The level of sophistication was so high that it was possible a state-backed actor might have been behind it, the official said.

There were conflicting accounts about the significance of the incursion.

“We were hacked,” U.N. human rights office spokesman Rupert Colville. “We face daily attempts to get into our computer systems. This time, they managed, but it did not get very far. Nothing confidential was compromised.”

The breach, at least at the human rights office, appears to have been limited to the so-called active directory - including a staff list and details like email addresses - but not access to passwords. No domain administration’s account was compromised, officials said.

U.N. spokesman Stephane Dujarric said in an email that the attack “resulted in a compromise of core infrastructure components” at the U.N. offices in Geneva and Vienna, and was “determined to be serious.”

In an email response, he wrote that the servers in Geneva that were targeted were part of a “development environment and contained non-sensitive, test data from two development servers used for web application development."

"There is no indication that data was exfiltrated from Vienna," he wrote. The U.N.'s Vienna office is home notably to the U.N.'s Office on Drugs and Crime.

Dujarric said the world body does not have enough information to determine who might have been behind the incursion, but added "the methods and tools used in the attack indicate a high level of resource, capability and determination.