Symantec: We Didn't Know in 2006 Source Code Was Stolen
Anti-virus giant Symantec says it did not know back in 2006 that source code for its software was stolen when it experienced a breach at that time. — The company surprised the public last week when it disclosed that hackers …
Context & Ripple Effects
Symantec's disclosure that hackers made off with source code during a 2006 breach — and that the company did not realize the theft had happened at the time — lands on a vendor whose credibility rests on being the authority on other people's breaches. The company publishes the Internet Security Threat Report and runs early-warning systems for enterprise customers, so the admission cuts against its core product: knowing what attackers hold.
It is also not Symantec's first self-inflicted trust problem. In June 2007 an errant antivirus definition update crippled thousands of Chinese PCs, and months later its own warning system sent enterprise customers a bogus alert about an Internet-crippling attack that turned out to be product testing. The pickup by Gizmodo and The Verge alongside Wired shows the story traveling well beyond the security trade press.
First-order effects
- Enterprise customers who bought Symantec endpoint protection on the strength of its threat intelligence now know the vendor sat on a six-year-old source-code theft it had not detected, forcing account teams to answer questions about what else went unnoticed.
- Symantec's disclosure framing — 'we didn't know in 2006' — shifts the story from the theft itself to the failure of detection, which is a harder sell for a company whose business is detection.
Second-order effects
- Rival antivirus and endpoint vendors face buyer due-diligence questions about their own historical breaches and whether stolen source code from any vendor is already circulating, turning disclosure latency into a competitive differentiator.
- Security procurement teams gain leverage to demand contractual breach-notification timelines from vendors, since a six-year gap between compromise and disclosure is now a documented precedent at a market leader.
Third-order effects
- If major security vendors can go years without knowing their own crown-jewel source code was taken, the industry's assumption that vendors are privileged detectors of compromise weakens, pushing toward regulatory or contractual minimums on breach discovery and notification.
- Source code itself gets reclassified in buyer risk models from an internal asset to a long-tail liability whose theft may surface publicly years later — raising the insurance, audit, and escrow bar for any software supplier.
The trend: Security vendors are increasingly becoming breach subjects rather than just breach narrators, and each delayed-disclosure case raises the pressure for enforceable notification standards across the software supply chain.