Company officials, victims, experts, and intel officials discuss the SolarWinds hack, which successfully compromised ~100 companies and a dozen govt. agencies
NPRDina Temple-Raston
Context & Ripple Effects
Four months after the campaign surfaced, NPR is convening the principals — company officials, victims, experts, intelligence officials — for a retrospective on an intrusion that reached about 100 companies and a dozen government agencies. The arc so far: the first confirmed federal hits at Treasury and Commerce, then the breach of DHS internal communications, and by late January investigators concluding the operation was broader than its entry point, with roughly 30% of victims having no SolarWinds connection.
The open forensic question is how the attackers got into SolarWinds itself: since early January, sources have pointed investigators toward the company's engineering operations in Czechia, Poland, and Belarus. A joint public accounting matters because the answer determines whether this was one poisoned build or a wider espionage platform.
First-order effects
Victim agencies and companies must now complete remediation on the assumption the intruders held access for months — Treasury's exposure potentially stretching back to mid-2020 per FOIA-documented timelines — while SolarWinds works to retain customers who trusted its update channel.
Second-order effects
If investigators confirm the Eastern European offices as the entry point, every vendor that offshored core engineering faces new procurement scrutiny, and SolarWinds' rivals gain a security-localization argument in government deals.
Third-order effects
With a large share of victims compromised without touching SolarWinds software, the pattern points toward regulators and buyers treating the software supply chain — not any single vendor — as the attack surface, pushing toward attestation requirements for updates and builds.
The trend: State-sponsored espionage is moving upstream into software vendors' build and distribution pipelines, making one compromise a lever into hundreds of downstream networks.
This long and not-very-technical article [https://www.npr.org/...] is about the SolarWinds hack. It ends with Mandia calling for a security NTSB, a suggestion that has been making the rounds for ages. Let me juxtapose it with another article: ↵
how hackers tinkered with SolarWinds' build process: “Imagine those Reese's Peanut Butter Cups going into the package and just before the machine comes down and seals the package, some other thing comes in and slides a razor blade into your Reese's Peanut Butter Cup.” https://twi…
Russia or China. https://www.npr.org/... Russia or China. https://www.thedrive.com/... We need power microgrids, small-scale water generation facilities, and urban vertical farms ASAP. https://twitter.com/...
“The tradecraft was phenomenal,” said Adam Meyers, who led the cyber forensics team that pawed through that tainted SolarWinds update. The code was elegant and innovative, he said, and then added, “This was the craziest f***ing thing I'd ever seen.” https://www.npr.org/...
“The speed with which an actor can move from espionage to degrading or disrupting a network is at the blink of an eye,” one senior administration said during a background briefing from the White House on Thursday. “.. a defender cannot move at that speed.” https://www.wgbh.org/..…
We worked on this story for the past 3 months, recording hours and hours of interviews, getting to the bottom of the one of the biggest hacks in U.S. history - Read @NPRDina's exclusive here. https://www.npr.org/...
How Russia Used SolarWinds To Hack Pentagon, Other Networks They would create a temporary update file with the malicious code inside while the SolarWinds code was compiling. The hackers' malicious code told the machine to swap in THEIR temporary files!!! https://www.npr.org/...
Want to understand why the SolarWinds attack is such a big deal? Our latest: A ‘Worst Nightmare’ Cyberattack: The Untold Story Of The SolarWinds Hack https://www.npr.org/...
The attack has spurred intelligence analysts to imagine the darkest scenarios: What if the hackers planted seeds for a future attack — and what must be done to stop them in their tracks? Read more here: https://www.npr.org/...