INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI Conducts Cybersecurity Audit of CJIS v6.1 System Infrastructure

| 2026-10-20 13:51 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 20, 2026, a cybersecurity incident was reported where stolen credentials were involved in approximately 44.7% of breaches, according to Verizon's Data Breach Investigation Report. The entity behind this attack is not specified. This breach affected agencies responsible for protecting Criminal Justice Information (CJI), with the goal of implementing Multi-Factor Authentication (MFA) and account management practices to prevent similar incidents. MFA can be implemented using phishing-resistant methods such as FIDO2 security keys, while solutions like Specops Secure Access help extend protection to Windows logons, RDP, RADIUS, and offline access. The current status is that agencies need to regularly review their configurations to ensure compliance with CJIS v6.1 requirements, including password policies, account management, and privileges.
Technical Mitigations AI-generated
• Implement FIDO2 security keys for phishing-resistant multi-factor authentication • Use Specops Secure Access to extend MFA protection to Windows logons, RDP, RADIUS, and offline access • Utilize Specops Password Policy to simplify password policy management across Active Directory, screen for compromised passwords, and limit failed login attempts
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎October 2024
Threat actors used compromised passwords to target agencies not adhering to CJIS password and MFA requirements.
general_metric 1 Priority
Passwords IA-5 sets an eight-character password minimum and is a Priority 1 control, so has been sanctionable since October 2024.
organisation Screen
Agencies should also: Screen for compromised passwords , updating password blocklists at least quarterly and whenever compromise is suspected.
organisation CJIS Systems Agency
Finally, check annual password change requirements with your CJIS Systems Agency, as IA-5 still specifies a yearly change or refresh despite guidance discouraging unnecessary resets.
organisation Logging Audit
Logging Audit logs help agencies detect suspicious activity and investigate security incidents.
organisation CA-5
In line with CA-5, you should update remediation plans at least every six months or when new information becomes available.
organisation Specops Password Auditor
Specops Password Auditor offers a free, read-only Active Directory scan that highlights password policy gaps against CJIS requirements and flags risks, including compromised passwords.
organisation Active Directory
Specops Password Auditor offers a free, read-only Active Directory scan that highlights password policy gaps against CJIS requirements and flags risks, including compromised passwords.
organisation CJIS
Specops Password Auditor offers a free, read-only Active Directory scan that highlights password policy gaps against CJIS requirements and flags risks, including compromised passwords.
organisation Specops
If you’re looking to simplify meeting CJIS password and MFA requirements, book a demo with Specops and see how we can help your agency strengthen security and maintain compliance.
‎2026/10/20
Threat actors are not mentioned in this snippet, but rather Verizon's Data Breach Investigation Report provides statistics on the involvement of stolen credentials in breaches.
organisation FIDO2
When implementing MFA, consider phishing-resistant methods such as FIDO2 security keys.
organisation Verizon’s Data Breach Investigation Report
Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches.
infrastructure Windows
Solutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.
organisation Specops Secure Access
Solutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.
organisation RDP
Solutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.
organisation CJIS v6.1 Compliance
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies.
organisation Criminal Justice Information
For agencies responsible for protecting Criminal Justice Information (CJI), meeting CJIS requirements means more than putting security controls in place.
organisation CJI
For agencies responsible for protecting Criminal Justice Information (CJI), meeting CJIS requirements means more than putting security controls in place.
organisation MFA
Multi-Factor Authentication CJIS v6.1 requires MFA for both privileged and non-privileged accounts under controls IA-2(1) and IA-2(2), covering local, network, and remote access.
organisation API
Its event API integrations also help provide evidence for compliance audits.
organisation Account Management
Try it for free Account Management and Privileges Access permissions can quickly become outdated as employees change roles or leave, a risk which CJIS v6.1 aims to reduce by enforcing effective account management and least privilege.
organisation Privileges Access
Try it for free Account Management and Privileges Access permissions can quickly become outdated as employees change roles or leave, a risk which CJIS v6.1 aims to reduce by enforcing effective account management and least privilege.
organisation Limit
Limit permissions to what is needed for each role, separate administrative privileges from everyday activities, and automate account provisioning and removal where possible.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Solutions like Specops Secure Access help agencies comply by extending MFA protection to Windows logons, RDP, RADIUS, and offline access, with flexible options including authenticator apps and YubiKeys.
Intelligence Sources
BleepingComputer 2026-10-20