Attack took place last week and “overcame robust security measures” the agency had in place to protect IT systems.