The US government has released updated figures on the number of companies and federal agencies it believes were impacted by the recent SolarWinds hack. “As of today, 9 federal agencies and about 100 private sector companies were compromised,” Deputy National Security Advisor Anne Neuberger said in a briefing, though she declined to name specific organizations. Although the hack was “likely of Russian origin,” Neuberger said the hackers launched their attack from inside the US.

The latest figures revealed are lower than the 250 federal agencies and businesses that were previously reported to have been infected, though Neuberger cautioned that the investigation is still in its “beginning stages” and that “additional compromises” may be found. In particular, the technology companies compromised gives hackers potential footholds for future attacks. Up to 18,000 SolarWinds customers are thought to have originally received the malicious code, though hackers did not attempt to gain additional access to all of them.

The hack originally came to light late last year, when it emerged that hackers had compromised SolarWinds’ monitoring and management software, which is used by multiple government agencies and Fortune 500 companies, Bloomberg notes. Companies including Intel, Nvidia, Cisco, Belkin, and VMWare have all reportedly seen computers on their networks infected, as well as the US Treasury, Commerce, State, Energy, and Homeland Security departments.

The scale of the attack means that it may be many months before the government completes its investigation. As part of the process, Neuberger said the government is planning an executive action to fix the security problems identified, and that “discussions are underway” about how to respond to the perpetrator.