A look at the worst hacks of 2020: SolarWinds, Twitter, Blueleaks, University Hospital Düsseldorf, Vastaamo, and Garmin
Lily Hay Newman / Wired :
Context & Ripple Effects
Wired's year-end audit closes a decade of notable breaches stretching back years with a 2020 defined by three distinct attack modes at once: a supply-chain compromise (SolarWinds' Orion updates), mass account takeover at Twitter, and ransomware against operational targets like Garmin and University Hospital Düsseldorf, where attackers shifted toward fewer, larger victims.
First-order effects
- SolarWinds customers face exposure through trusted Orion software updates rather than direct intrusion, making the compromise hard to scope quickly.
- Vastaamo's leaked patient records and BlueLeaks' published law-enforcement files put sensitive personal and institutional data directly into public circulation, while Garmin and Düsseldorf users endured service outages.
Second-order effects
- The ransomware cases feed the shift documented two days later toward big-game hunting — fewer targets, massive demands — pressuring insurers and negotiators who priced incidents around many small payments.
- SolarWinds turns every affected vendor's update pipeline into an audit target, since the attack rode distribution channels customers had no reason to distrust.
Third-order effects
- If supply-chain compromise and big-game ransomware keep compounding, security spending migrates from perimeter defense toward vetting software provenance and assuming critical infrastructure will be hit.
- The annual worst-hacks retrospective itself is consolidating into an institutional record — Wired repeated the format for 2022 — shaping which incidents policymakers treat as canonical.
The trend: Cyberattacks in the 2020s are converging on trusted delivery channels and high-value operational targets, replacing volume-of-small-breaches economics with few-but-catastrophic campaigns.