In December 2020, the SolarWinds data breach came to light, revealing a highly sophisticated cyberattack believed to be orchestrated by the Russian Foreign Intelligence Service. The attackers exploited SolarWinds' Orion software updates, compromising the networks and systems of numerous organizations, including government agencies and private companies.

How many accounts were compromised?

The breach impacted data related to approximately 50 million users.

What data was leaked?

The data exposed in the breach included credit card numbers, expiration dates, cardholder names, billing addresses, and CVV codes.

How was SolarWinds hacked?

In the SolarWinds data breach, suspected Russian hackers compromised the company's Orion software updates by injecting malicious code, creating a backdoor for unauthorized access. This supply chain attack allowed the threat actors to infiltrate the networks and systems of thousands of organizations, including government agencies and private companies. The hackers used novel techniques to modify sealed software code and mimic legitimate communication protocols, making their activities difficult to detect. The breach began with a proof of concept in September 2019, followed by the deployment of a new implant in February 2020.

SolarWinds's solution

In response to the hack, SolarWinds took several measures to secure its platform and prevent future incidents. This included working with cybersecurity experts like FireEye and Microsoft to remove the malware and backdoors used by the attackers, releasing patches for the malware and other potential vulnerabilities, and enhancing security protocols. SolarWinds also communicated with affected customers, providing guidance on how to protect their systems and data. The company is working towards becoming a "secure by design" organization, focusing on software development and building robust threat protection and detection tools across its network.

How do I know if I was affected?

SolarWinds notified customers believed to be affected by the breach. If you're a SolarWinds customer and haven't received a notification, you may visit Have I Been Pwned to check your credentials.

What should affected users do?

In general, affected users should:

1. Change Your Password: Immediately update your password for the breached account. Make sure the new password is strong and unique, not previously used on any other platform.

2. Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.

3. Enable Two-Factor Authentication (2FA): Activate 2FA on the breached account. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.

4. Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report it immediately to the respective platform or service provider.

For more specific help and instructions related to the SolarWinds data breach, please contact SolarWinds Support directly.

Where can I go to learn more?

If you want to find more information on the SolarWinds data breach, check out the following news articles:

• Autodesk targeted in SolarWinds hack

• Why Russia may have stepped up its hacking game