He said the U.S. should do more than just enforce sanctions.
"The methods used to carry out the cyberhack are consistent with Russian cyber operations," Rubio, acting chairman of the Senate Intelligence Committee said in a tweet. "But it’s crucial we have complete certainty about who is behind this. We can’t afford to be wrong on attribution, because America must retaliate, and not just with sanctions."
The Department of Homeland Security announced Thursday that the cyber breach began in March by "a patient, well-resourced and focused adversary."
Though reports have surfaced suspecting Russian involvement, the security agency has not confirmed who carried out the attacks yet, and President Trump has remained quiet on the subject.
The Cybersecurity and Infrastructure Security Agency said the attack compromised federal agencies’ "critical infrastructure" in a manner that was hard to detect and will be difficult to undo – leaving the scope of the attack largely undisclosed as of right now.
"CISA has determined that this threat poses a grave risk to the Federal Government and state, local, tribal, and territorial governments as well as critical infrastructure entities and other private sector organizations," the alert issued Thursday said. "CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations."
CISA was established by Trump in 2018 to "build the national capacity to defend against cyber attacks" and to work "with the federal government to provide cybersecurity tools, incident response services and assessment capabilities to safeguard the .gov networks that support the essential operations of partner departments and agencies."
The agency announced the breach was made using SolarWinds Orion, a software vendor, though evidence suggests other avenues were involved in the breach as victims were discovered who did not use SolarWinds Orion products.
Rubio said the attack is close to "an act of war" in an interview with Fox News’ Laura Ingraham Thursday night.
"You saw the bulletin tonight, it went out, it’s a grave risk to federal, to state, to local governments, to critical infrastructure, to the private sector," Rubio said. "And as far as attribution, when you attribute it to somebody, you have got to know it for sure because it’s a very — this is almost, I would argue — an act of war, absolutely."
Morgan Phillips contributed to this piece.