What information was stolen from JPL during the Raspberry Pi hack?

Question

The Engadget article A rogue Raspberry Pi helped hackers access NASA JPL systems highlights an incident where a networked Raspbery Pi at JPL was used to gain access to several other networks, including DSN.

NASA's Jet Propulsion Laboratory (JPL) suffers from multiple cybersecurity weaknesses despite the advances it has achieved in space technology, according to the agency's Office of Inspector General (PDF). Investigators looked into the research center's network security controls after an April 2018 security breach, wherein a Raspberry Pi that was not authorized to be linked to the JPL network was targeted by hackers. The attackers were able to steal 500 megabytes of data from one of its major mission systems, and they also used that chance to find a gateway that allowed them to go deeper into JPL's network. (emphasis added)

Diving deeper into the system gave the hackers access to several major missions, including NASA's Deep Space Network -- its network of spacecraft communication facilities. As a result, the security teams of some sensitive programs, such as the Orion Multi-Purpose Crew Vehicle and the International Space Station, have chosen to disconnect from the agency's network.

Question: What information was stolen from JPL during the Raspberry Pi hack? What was in the "500 megabytes of data from one of its major mission systems"? Was it for example design details of the Orion spacecraft, or images of one of Saturn's moons?

Answer 1

As an information security professional this makes me cringe, but I'm not in the last surprised. I've read the OIG report, there's not that much information on the data that is lost, but the report states on page 10:

Prior to detection and containment of the incident, the attacker exfiltrated approximately 500 megabytes of data from 23 files, 2 of which contained International Traffic in Arms Regulations information related to the Mars Science Laboratory mission.

International Traffic in Arms Regulations (ITAR) is a law preventing the transfer of military applicable technology, it was most likely something to do with the design of the rover or scientific instruments which were derived from classified military technology. From the same page:

More importantly, the attacker successfully accessed two of the three primary JPL networks. Accordingly, NASA questioned the integrity of DSN data related to space flight systems and temporarily disconnected several space flight-related systems from the JPL network.

The document sites poor network segmentation between NASA and the JPL, and that after the April 2018 attack using the pi NASA cut their links. It's very possible that the DSN had traffic from classified missions at the time. If that's the case I doubt there's be any details on that publicly.