According to the initial analysis made by the state officials, Arizona lawmakers did not appear to have been hacked by Russians hackers.
The state shut down their servers which gave an external access to its human resources and payroll systems last weekend. After the state lawmakers and legislative staff reported that they have been receiving an email which asked them to reset their passwords, after clicking upon the link, a new window popped up with Russian language.
According to the Arizona Department of Administration website, their system handles HR and payroll issues for 40,000 state employees and calculates around $2.5 billion in the annual payroll.
Officer Mike Lettman of Arizona Chief Information Security sent an email to legislative staff on Friday night warning them about the issue.
"At this point at a minimum anyone who clicked on the link or tried to change their HRIS (Human Resources Information Solution) password has their login and password compromised," Lettman said in the email. "In addition to clicking on the link may have compromised their computers or laptop was infected to begin with."
According to the Arizona Department of Administration's initial assessment, the issue was isolated to about 100 people.
On Monday afternoon, department spokesperson Megan Rose said the investigation was being carried out, but initial indications showed that the emails were legitimate.
"We have ruled out the phishing hack and we believe the incident is isolated to only a few computers," Rose said. "One of the possibility that we are looking into is the computers have malware on them and it has the ability to change browser language settings. We are running forensic analysis on those computers to find out further information."
Rose also said that there was no evidence of tampering within the payroll system, but investigators are still continuing to monitor it for suspicious activity.
Arizona lawmakers hacked, got message in Russian!
AMandeep