U.S. lawmakers briefed on the massive cybersecurity security breach that has affected government agencies and the private sector are calling for the country to act, warning that, so far, all evidence is pointing to Russia as the culprit.
The admonitions, from both Republicans and Democrats, follow warnings from U.S. cybersecurity officials that the scope of the hack is potentially much bigger than originally thought, encompassing multiple software platforms going back at least as far as March of this year.
"There was a significant effort to use a piece of third-party software to essentially embed code inside of U.S. government systems," U.S. Secretary of State Mike Pompeo said on on Friday, according to a report by Agence France-Presse.
"This was a very significant effort, and I think it's the case that now we can say pretty clearly that it was the Russians that engaged in this activity,” Pompeo said of the cyberattack on U.S. agencies as well as targets worldwide.
Republican Marco Rubio, the acting chairman of the Senate Intelligence Committee, tweeted on Friday: “The full extent of the cyberhack is still unknown but we already know it is unprecedented in scale & scope.”
"The methods used to carry out the cyberhack are consistent with Russian cyber operations," Rubio added, warning that once officials can attribute the intrusion with complete certainty, "America must retaliate, and not just with sanctions."
The full extent of the cyberhack is still unknown but we already know it is unprecedented in scale & scope, in all likelihood ongoing & at a level of sophistication only a few nation-states are capable of.
The top Democrat on the Senate Intelligence Committee likewise expressed alarm about the hack, describing the breach as devastating.
"An incident of this magnitude and lasting impact requires an engaged and public response by the U.S. government," Senator Mark Warner said in a statement issued Friday. "It is extremely troubling that the president does not appear to be acknowledging, much less acting upon, the gravity of this situation."
Indications of a cyber intrusion first went public earlier this month when the private cybersecurity firm FireEye announced its systems had been penetrated and that sensitive information had been stolen.
The hack was later traced to updates for network management software from a Texas-based company called SolarWinds, which the hackers exploited to get into the networks of at least 18,000 users.
In an updated alert issued Friday, the cybersecurity unit of the U.S. Department of Homeland Security warned the hackers had been exploiting the SolarWinds software update going back to at least March.
But the Cybersecurity and Infrastructure Security Agency (CISA) further warned the problem was not contained to SolarWinds.
"CISA has evidence of initial access vectors other than the SolarWinds Orion platform," the alert warned, saying the agency is investigating instances in which other platforms were used to access critical networks.
"This threat poses a grave risk to the federal government and state, local, tribal and territorial governments, as well as critical infrastructure entities and other private sector organizations," CISA said. "This is a patient, well-resourced and focused adversary that has sustained long duration activity on victim networks."
Research by tech giant Microsoft, made public Thursday, indicated the hackers precisely targeted at least 40 organizations. The vast majority were in the United States, but companies in Canada, Mexico, Britain, Belgium, Israel and the United Arab Emirates were also attacked.
"This is not 'espionage as usual,' even in the digital age," Microsoft President Brad Smith wrote on the . "This is not just an attack on specific targets, but on the trust and reliability of the world's critical infrastructure."
Former U.S. government officials also worried about the impact of the hack.
"The scope of it is large but exactly how large remains to be seen, and exactly how severe remains to be seen," Michael Daniel, who served as a special assistant to former U.S. President Barack Obama on cyber issues, told VOA's Russian Service.
"The damage could be very, very significant to U.S. national security and to our economic security," he said.
Yet despite the warnings from current and former government officials, and private security firms, as of late Friday, U.S. President Donald Trump had yet to comment on the breach.