Russia said Monday it had “nothing to do with” the hacking. Neither the US government nor the affected companies have publicly said which nation-state they think is responsible.Ī US official, speaking on condition of anonymity because of an ongoing investigation, told the Associated Press on Monday that Russian hackers were suspected. SolarWinds said it was advised that an “outside nation-state” had infiltrated its systems with malware. The hackers may have been monitoring email and other internal communications. SolarWinds is working with FireEye as well as the FBI, the intelligence community, and other law enforcement to investigate the breach, said Kevin Thompson, the CEO and president of SolarWinds.īecause this software monitors entire networks, a large share of what companies and organizations do online is at risk of a breach. Just because a company or agency uses SolarWinds as a vendor doesn’t necessarily mean it was vulnerable to the hacking.įireEye described the malware’s dizzying capabilities – from initially lying dormant up to two weeks to hiding in plain sight by masquerading its reconnaissance forays as Orion activity. Neither SolarWinds nor US cybersecurity authorities have publicly identified which organizations were breached. SolarWinds said it sent an advisory to about 33,000 of its Orion customers who might have been affected, though it estimated a smaller number of customers – fewer than 18,000 – had actually installed the compromised product update earlier this year.

“The reason these systems are good targets is because they’re deeply embedded in systems operations and administration.” “These types of tools are allowed deep access to systems,” said Brandon Hoffman, the chief information security officer at the California-based IT provider Netenrich.

Orion’s centralized monitoring looks for problems in an organization’s computer networks, which means that breaking in gave the attackers a “God view” of those networks. Its compromised product, Orion, accounts for nearly half of SolarWinds’ annual revenue (the company has brought in more than $750m this year). SolarWinds, of Austin, Texas, provides network-monitoring and other technical services to hundreds of thousands of organizations around the world, including most Fortune 500 companies and government agencies in North America, Europe, Asia and the Middle East. The scale of the hack is potentially global and, because the affected software touches many parts of a business, potentially devastating for organizations. Who has been affected, and how bad is it ? He would not name any but said he expected many more to learn in coming days that they, too, had been infiltrated. Government officials have not yet stated which agencies were affected but the Centers for Disease Control and Prevention, the state department, and the justice department all use the software in question.Ĭharles Carmakal, a FireEye executive, said the company was aware of “dozens of incredibly high-value targets” compromised by the hackers and was helping “a number of organizations respond to their intrusions”. The apparent months-long timeline gave the hackers ample time to extract information from many targets. FireEye has not publicly blamed its own breach on the SolarWinds hack, but it reportedly confirmed that was the case to the tech site Krebs On Security on Tuesday. The breach was not discovered until the prominent cybersecurity company FireEye, which itself also uses SolarWinds, determined it had experienced a breach by way of the software. Vinoth Kumar, a security researcher, told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123”. That malware gave elite hackers remote access to an organization’s networks so they could steal information.ĭoing so may not have been difficult. The hack began as early as March, when malicious code was sneaked into updates to popular software called Orion, made by the company SolarWinds, which monitors the computer networks of businesses and governments for outages.

Apple data breach 2020