Nasdaq confirms servers hacked via web-facing application

The company that owns the Nasdaq stock market today confirmed that servers in the U.S. were hijacked as part of a hacking attack but made it clear the breach was "unrelated to our trading systems."

The company's admission follows a weekend Wall Street Journal report that hackers "repeatedly penetrated" the Nasdaq's computer network over the course of several months.  The newspaper said investigators are  are considering a range of possible motives, including unlawful financial gain, theft of trade secrets and a national-security threat designed to damage the exchange.

The mysterious hack -- details are being kept under wraps by Secret Service and FBI investigators -- included an attack against a Web facing application called Directors Desk.  The application is billed as a "secure, online Board portal that provides corporate governance software, communication tools and Board management software that increase Board effectiveness."

Nasdaq said it spotted suspicious files during normal security monitoring systems and says there is no evidence that any Directors Desk customer information was accessed or acquired by hackers.

The company said it was asked by the U.S. Department of Justice to refrain from going public with the attack until February 14, 2011 but was forced to provide notification after Wall Street Journal ran its story.

Here's the statement from the Nasdaq OMX Group:

Through our normal security monitoring systems we detected suspicious files on the U.S. servers unrelated to our trading systems and determined that our web facing application Directors Desk was potentially affected. We immediately conducted an investigation, which included outside forensic firms and U.S. federal law enforcement. The files were immediately removed and at this point there is no evidence that any Directors Desk customer information was accessed or acquired by hackers. Our trading platform architecture operates independently from our web-facing services like Directors Desk and at no point was any of NASDAQ OMX’s operated or serviced trading platforms compromised.

Subsequently, the U.S. Department of Justice requested that we refrain from providing notice to our customers until, at the earliest, February 14, 2011, in order to facilitate the continuing investigation. NASDAQ OMX was honoring the U.S. Government’s request to delay notification, but when a story ran in the media on Saturday, February, 5, 2011, regarding a hacking incident at NASDAQ OMX, we immediately decided, in consultation with the authorities, that we must inform our customers.

We continue to evaluate and enhance our advanced security controls to respond to the ever increasing global cyber threat and continue to devote extensive resources to further secure our systems. Cyber attacks against corporations and government occur constantly. NASDAQ OMX remains vigilant against such attacks. We have been working in cooperation with the Government’s ongoing investigations and have received their technical advice for which we are appreciative.

* Image via bfishadow's Flickr photostream (CC 2.0).