in a research report that credentials belonging to 47 US government agencies have been found across 89 unique domains.
CIA-backed startup had also said that, in early 2015, 12 of these agencies, including the Departments of State and Energy, allowed some of their users access to computer networks with no form of two-factor authentication.
The startup used the Recorded Future Web Intelligence Engine, an "analytics" engine designed to seek out "invisible links" between content streams which talk about "the same, or related, entities and events." The engine scanned over 680,000 Web sources in multiple languages, linking together contextual data and sources in order to ferry out the credentials belonging to governmental bodies.
This lead the agencies vulnerable to espionage, socially engineered attacks, and tailored spear-phishing attacks against their workforce.
The reports also says that most of the credentials were found on paste sites, which may have been stole by exploiting third party services. They mentioned -
"In many cases, our research identified the immediate removal of the credentials by sites such as pastebin.com. However, to Recorded Future's knowledge, no efforts are made to contact government agencies whose credentials may be posted on a paste site. Further, while the information may be removed from a paste site, it likely still circulates in private circles and is available to the original attackers."Source - Zdnet