Mariam Taha Thompson, 61, is accused of delivering classified information to an unidentified co-conspirator who worked for the Lebanese government and has “apparent connections” to Hezbollah, the Lebanese Shiite group designated a foreign terrorist organization by the State Department.

While working as a contract linguist assigned to a special operations task force in Erbil, Iraq, Thompson allegedly “accessed dozens of files concerning human intelligence sources, including true names, personal identification data, background information, and photographs of human assets” during a six-week period between late December and early February, the release stated.

“While in a war zone, the defendant allegedly gave sensitive national defense information, including the names of individuals helping the United States, to a Lebanese national located overseas,” said John C. Demers, assistant attorney general for national security, in the release. “If true, this conduct is a disgrace, especially for someone serving as a contractor with the United States military. This betrayal of country and colleagues will be punished.”

Thompson was arrested by agents with the Federal Bureau of Investigation on Feb. 27 at the overseas military facility where she worked. Throughout her time as a linguist, she held a top-secret security clearance.

“The Department of Defense is aware that the Department of Justice charged a DoD contractor with serious criminal offenses,” Alyssa Farah, Defense Department press secretary, said in an emailed statement. “DoD will continue to cooperate with the DOJ throughout its investigation. DoD is taking all necessary precautions, including the protection of U.S. forces. At this time, we refer all questions on this matter to DOJ.”

The arrest came after a multi-agency investigation which involved the FBI’s Counterintelligence Division, the Pentagon, the Justice Department and the U.S. Attorney for the District of Columbia, the release added.

“The conduct alleged in this complaint is a grave threat to national security, placed lives at risk, and represents a betrayal of our armed forces,” said Timothy J. Shea, U.S. attorney for the District of Columbia, in the release. “The charges we’ve filed today should serve as a warning to anyone who would consider disclosing classified national defense information to a terrorist organization.”

Around Dec. 30, officials noticed a “notable shift” in Thompson’s network activity on classified systems around the time protesters attempted to storm the U.S. embassy, a day after U.S. military airstrikes on Iranian-backed militia forces.

U.S. forces struck five targets of Iraqi-based Hezbollah affiliates in both Iraq and Syria, two days after a rocket attack from Iranian-backed militias on an Iraqi Security Forces base in Kirkuk, Iraq, Military Times previously reported. That attack led to the death of one American contractor.

These exchanges led to a spiraling of tensions which culminated in the U.S. airstrike that killed Iranian Quds Force commander, Qasem Soleimani, near Baghdad International Airport in early January, and an Iranian ballistic missile response on two Iraqi bases housing coalition troops.

This attack resulted in over 100 U.S. service members sustaining mild traumatic brain injuries, according to the latest Pentagon figures.

On Feb. 19, a search of the linguist’s living quarters “led to the discovery of a handwritten note in Arabic concealed under” Thompson’s mattress, which contained classified information, the release stated.

When asked by investigators if her co-conspirator was involved in Hezbollah or a separate Shiite Lebanese political party, the linguist responded “Yeah, one of the two. They are the same,” according to the Justice Department affidavit.

The affidavit also states that Thompson took screenshots of handwritten Arabic notes containing memorized classified information, often naming human assets in the area of operations. Thompson admitted to having a “romantic interest” in the co-conspirator, the release said.

Thompson appeared briefly in Washington’s federal court, where she was ordered held without bond pending a detention hearing next week. Neither she nor her lawyer addressed the allegations in court.

If convicted, she faces a maximum sentence of life in prison.

This article contains information from the Associated Press.

Story has been updated to include a statement from the Pentagon.

Lockheed Martin, General Dynamics, Boeing and SpaceX are among dozens of companies named as victims of compromised data, accessed through the hacking of Visser Precision LLC, a Colorado-based aerospace, automotive and industrial parts manufacturer.

DoppelPaymer, a ransomware group, perpetrated the hack, according to Brett Callow, a threat analyst with Emsisoft.

[To see a photo (courtesy of Brett Callow/Emsisoft) posted to a hacker group website listing dozens of U.S. businesses whose data hackers claim to possess, click here.]

“Visser Precision, LLC was the recent target of a criminal cybersecurity incident, including access to or theft of data. The company continues its comprehensive investigation of the attack, and business is operating normally,” Visser Precision said in an emailed statement to Fifth Domain. “Visser Precision will continue full cooperation with its customer partner companies.”

The hacker group, which is a variant of actor BitPaymer, has been active for over a year but only recently began releasing compromised information, Callow said. The group’s website features an ominous message to “stay tuned” for a “LOT” more data to come “by parts.”

While threatening to release additional data, the group has already posted personnel information from industry corporations, government officials and subcontractors from 2016, as well as a partial document related to a missile antenna from Lockheed Martin from 2011.

“We are aware of the situation with Visser Precision and are following our standard response process for potential cyber incidents related to our supply chain,” a Lockheed Martin spokesperson told Fifth Domain. “Lockheed Martin has made and continues to make significant investments in cybersecurity, and uses industry-leading information security practices to protect sensitive information. This includes providing guidance to our suppliers, when appropriate, to assist them in enhancing their cybersecurity posture.”

Hacker groups — such as Maze, which previously released veterans’ sensitive information online — have targeted various government entities, law firms and businesses in the last year, as reported by Military Times, a sister publication of Fifth Domain.

Standard to other ransomware attacks, the hackers appear to have gained access to Visser Precision’s system, exfiltrating data before demanding payment to prevent a wider release.

“[The hackers] started by publishing older and less sensitive data,” Callow told Fifth Domain over email. “The more data they publish and the more sensitive that data is, the less incentive the company has to pay to prevent the remaining data being published.”

The Department of Defense recently announced an upcoming demonstration to test U.S. Air Force capabilities with SpaceX-developed Starlink technology. The released data, however, does not pertain to this platform.

SpaceX, General Dynamics and Boeing all did not immediately respond to requests for comments.

Callow, who monitors hackers’ activities, said DoppelPaymer has previously claimed in online posts to have stolen data in additional, unrelated incidents, and he believes more information will likely be released soon.

“This attack is particularly worrisome because of the nature of the information that may have fallen into the hands of cybercriminals,” Callow said. “Obviously, this [hack] could put the intellectual property of the companies’ concerned at risk and possibly even pose a risk to national security.”

The Federal Bureau of Investigation alerted businesses last October about “high-impact ransomware attacks” that specifically target government entities and corporations to encrypt data and unlock it for a fee, Fifth Domain previously reported.

In the last 48 hours, Maze separately published stolen information from a Canadian provincial government, state-owned Mexican petroleum company Pemex and a French telecommunications company, Callow added.

A 2019 Emsisoft report found that ransomware attacks targeted 113 state and municipal governments and agencies, 764 health care providers, and 89 universities, colleges and school districts nationwide.

Maze, a hacking and ransomware group, has breached several law firms, local government databases and other companies, demanding payments for data recovery and deletion. The posted information includes VA documents, patient care records, legal fee agreements and privacy consent forms.

Two of those hacks targeted Texas-based law firm Baker Wotring in November and Woods and Woods LLC in Evansville, Indiana, this month, the Evansville Courier & Press reported.

Woods and Woods is a nationwide disability benefits firm that deals with U.S. Department of Veterans Affairs litigation.

“[Woods and Woods LLC] has notified the FBI and has taken and continues to take prompt action to contain the incident, mitigate its effects, and fully investigate,” said Neil Woods in an emailed statement to Military Times. “The firm is able to continue conducting its business since it had backups in place. The firm will provide additional information to its clients as the investigation continues.”

It is unclear, however, whether clients from the firms are aware some of their sensitive information has already posted to the web.

Baker Wotring did not respond to a request for comment.

Maze hacks an organization’s servers, notifies them of the breach and demands ransom payments to prevent data dumps, according to Brett Callow, a threat analyst with Emsisoft. If the group does not receive payment, it will publish small amounts of compromised data — “proofs” — online, accessible to anyone with internet access.

The group has previously demanded payments ranging from $1 million to several million dollars, and if payment is not received, Maze will release additional sensitive data on a staggered basis, Callow explained. Maze has already released a portion of personal documents from Woods and Woods, and the group claims to have more information.

Maze has also posted the compromised data to a Russian hacker forum, Callow said.

In some cases, other hackers will use the stolen information to target and demand ransom from individual patients or clients. Maze itself wrote on its site, “Use this information in any nefarious way that you want,” Callow said.

Ransomware and malware breaches have become devastated organizations in recent years, often crippling their ability to function or demands extraordinary sums of money.

A 2019 Emsisoft report found that 113 state and municipal governments and agencies, 764 health care providers, and 89 universities, colleges and school districts nationwide.

These groups prefer to target smaller firms with less secure cybersecurity infrastructure, Callow previously told Law.com. The Federal Bureau of Investigation (FBI) issued a Flash Alert last month to private companies to notify them of increased Maze ransomware activities, BleepingComputer reported.