incident · 1300320000000

RSA SecurID Seed Warehouse Breach

State-sponsored hackers breached RSA Security and stole the foundational seed values for its SecurID two-factor authentication tokens, compromising the security of millions of users worldwide.

What happened

In March 2011, hackers infiltrated RSA's network via a spear-phishing email containing a malicious Excel spreadsheet. They navigated the network and successfully exfiltrated the 'seed warehouse'—a database containing the secret keys used to generate two-factor authentication codes for RSA's SecurID tokens.

Technical mechanism

The attackers used a zero-day vulnerability in Adobe Flash embedded in an Excel spreadsheet to drop the Poison Ivy Remote Access Trojan (RAT). They then moved laterally to locate and exfiltrate the SecurID seed database via FTP to a compromised Rackspace server.

Why it matters

The theft of SecurID seeds undermined a core security control used by defense contractors, governments, and corporations, representing one of the earliest and most impactful supply chain attacks by a nation-state.

Impact

The stolen seeds allowed attackers to clone SecurID tokens and bypass two-factor authentication. This access was subsequently used to breach defense contractors like Lockheed Martin.

Response

RSA launched a massive incident response effort, eventually offering token replacements or free security monitoring to its 30,000+ customers.

Defensive lessons

  • Supply chain dependencies represent critical single points of failure.
  • Organizations must protect foundational cryptographic material with extreme rigor.
  • Spear-phishing remains a highly effective initial access vector.

Evidence register

  1. The New York Times — SecurID Company Suffers a Breach of Data Security (verified)
  2. Wired — The Full Story of the Stunning RSA Hack Can Finally Be Told (verified)