Chemical facilities warned of possible data theft in CISA CSAT breach

CISA confirmed that an Ivanti Connect Secure appliance backing the Chemical Security Assessment Tool (CSAT) was breached on 2024-01-23 when a web shell was uploaded and used over two days; this may have exposed Top-Screen surveys, Security Vulnerability Assessments, Site Security Plans, Personnel Surety submissions, and CSAT account PII. The agency links the incident to exploitation of multiple Ivanti vulnerabilities (several disclosed CVEs), took the device offline to investigate, and is notifying impacted individuals and organizations despite reporting no current evidence of data exfiltration.