The agency has not publicly assigned a specific CVE identifier for the flaw in the information released so far, so the vulnerability should be tracked by the vendor advisory once it becomes available. Details on the exact VPN product and affected versions have also not been fully outlined in the disclosure.

Key points:

• Approximately 246,000 record rows may have been exposed
• The data involved personal information of government personnel
• The root cause was a VPN vulnerability
• The Digital Agency is continuing its investigation into the scope and impact

Personnel whose information may have been caught up in the incident should monitor for follow-up guidance from the agency, and administrators running similar VPN appliances should apply vendor patches as soon as they are released and review access logs for signs of exploitation.

Source: BleepingComputer

Does your organization run the same class of VPN appliance, and if so, have you already patched or begun hunting for signs of compromise?