WASHINGTON — China’s military hacked into computer networks of civilian transportation companies hired by the Pentagon at least nine times, breaking into computers aboard a commercial ship, targeting logistics companies, and uploading malicious software onto an airline’s computers, Senate investigators said Wednesday.
A yearlong investigation announced by the Senate Armed Services Committee identified at least 20 break-ins or other unspecified cyber events targeting companies, including nine successful break-ins of contractor networks. It blamed China’s government for the most sophisticated intrusions, although it did not provide any detailed evidence.
The Senate report did not identify which transportation companies were victimized.
Investigators said China’s military was able to steal e-mails, documents, user accounts, and computer codes. They also said China compromised systems aboard a commercial ship contracted by Transcom for logistics routes, and hacked into an airline the US military used.
The committee’s chairman, Senator Carl Levin, Democrat of Michigan, said the hacking put at risk the security of US military operations. He called his committee’s findings ‘‘very disturbing.’’
China’s government did not immediately respond Wednesday to telephone messages and e-mails requesting comment in Beijing, its embassy in Washington, and offices at the United Nations.
The newly declassified Senate report says defense contractors have generally failed to report to the Pentagon hacker break-ins of their systems as required under their business agreements.
Levin, whose staff investigated the break-ins with the committee’s top Republican, Senator Jim Inhofe of Oklahoma, said government agencies also failed to share information among themselves about intrusions. He said that hampers the government’s ability to protect national security.
For instance, the committee said some contractors that contacted the FBI about break-ins may have not separately reported the intrusions to Transcom because the firms assumed the bureau had notified the Pentagon. Levin said he and Inhofe were working on streamlining the reporting process.
Federal data show more than $4 billion in contracts went to firms in 2012 and 2013 for the Civil Reserve Air Fleet, a Transcom partnership with private airlines that supplements Pentagon airlifts during wars or natural disasters. Six of 11 companies that investigators contacted about cyber intrusions were Civil Reserve airlines.
The largest recipient of reserve fleet funding during that period, FedEx Corp., did not answer questions from the AP on Wednesday asking whether it was a victim of hacking. In a written statement, it instead said generally it was ‘‘confident in the integrity and safety of our systems, including those supportive of our government contracts.’’
Other Transcom contractors included firms that have since filed for bankruptcy and ended operations, including Georgia-based World Airways Inc.
The significant intrusions were characterized as ‘‘advanced-persistent attacks,’’ a category of threats so sophisticated they are frequently associated with foreign governments. Of those intrusions, Transcom was made aware of only two, which the committee’s report said was troubling.
Some intrusions appeared to come from mundane ruses that targeted employees by e-mail, a practice known as spear-phishing. In 2013, for example, an unnamed Civil Reserve airline was the victim of a phishing attack that investigators suspect led to malicious software being downloaded on the airline’s network.
.