The RSA SecurID Breach

Background

RSA Security, a subsidiary of the U.S. technology company EMC Corporation, was one of the world's best-known vendors of two-factor authentication technology. Its SecurID hardware and software tokens generated constantly changing numeric codes that, combined with a user's password, were used by tens of millions of employees at banks, government agencies, and defense contractors to log into sensitive networks. The security of the system depended on a database of secret "seed" values, each uniquely tied to a token's serial number, which RSA kept under tight control.

The Attack

On March 17, 2011, RSA disclosed that it had suffered what it called an extremely sophisticated cyberattack. According to RSA's own account and subsequent reporting, the intrusion began when a small number of RSA employees received spear-phishing emails, one bearing the subject line "2011 Recruitment Plan," that carried a malicious Microsoft Excel attachment. When opened, the spreadsheet exploited a then-unknown (zero-day) vulnerability in Adobe Flash Player embedded in the file, allowing the attackers to install the Poison Ivy remote access trojan on the victim's machine and gain a foothold inside RSA's corporate network.

What Was Compromised

From that initial foothold, the attackers moved through RSA's systems and ultimately extracted information related to the SecurID product, widely reported to include data from the database mapping token serial numbers to their secret seed values. RSA did not publicly disclose the full technical details of what was taken, but the company acknowledged that the theft could reduce the effectiveness of SecurID two-factor authentication deployments and urged customers to tighten related security practices, such as protecting token serial numbers and hardening other authentication factors.

The Lockheed Martin Intrusion Attempt

In May 2011, reports emerged that defense contractor Lockheed Martin had detected an intrusion attempt against its network that investigators linked to the stolen RSA SecurID data. Lockheed Martin stated that its security team's rapid response prevented any loss of customer, program, or employee data, and it temporarily suspended remote access for employees as a precaution. Other RSA SecurID customers, including defense contractor L-3 Communications, were also reported to have faced related attack attempts around the same period, underscoring that the stolen seed data was being actively used against high-value targets beyond RSA itself.

RSA's Response and the Token Replacement Program

Facing mounting pressure over the scope of the breach, RSA announced on June 6, 2011, that it would offer token replacements or free security monitoring services to essentially all of its SecurID customers, a program that ultimately reached tens of thousands of corporate clients. RSA executive chairman Art Coviello maintained publicly that "we believe and still believe that the customers are protected," even as the company undertook the costly remediation. EMC later disclosed that the breach and its aftermath, including the token-replacement program, cost the company approximately $66.3 million.

Attribution and Legacy

RSA characterized the intrusion as an advanced persistent threat resembling other contemporary espionage-style campaigns of the period, such as the Sykipot and Night Dragon attacks. In the weeks following the Lockheed Martin incident, several news reports cited unnamed investigators and security researchers linking the follow-on attacks to China-based actors, although no U.S. government agency issued a formal, named attribution at the time. The breach was later recognized at the 2011 Pwnie Awards, an industry event that highlights notable security successes and failures, where the RSA SecurID compromise received the "Lamest Vendor Response" award. The incident is now widely taught as an early, influential example of how a narrowly targeted phishing attack against a handful of employees can cascade into a global authentication-security crisis.

Timeline

• 2011-03RSA employees receive spear-phishing emails, including one titled "2011 Recruitment Plan," carrying a malicious Excel attachment with a Flash zero-day exploit.
• 2011-03-17RSA publicly discloses that it suffered an "extremely sophisticated" cyberattack affecting its SecurID two-factor authentication products.
• 2011-05Defense contractor Lockheed Martin detects and repels an intrusion attempt linked to data stolen in the RSA breach; remote employee access is temporarily suspended.
• 2011-06-06RSA announces it will offer SecurID token replacements or free monitoring to affected customers.
• 2011-08The RSA SecurID compromise receives the "Lamest Vendor Response" award at the annual Pwnie Awards.