A major cyberattack announced over the weekend on SolarWinds—a security vendor that serves a wide range of military, private companies, government agencies, and academic institutions—may have allowed hackers to gain access to the emails, systems and data of several of its clients, including the Treasury and Commerce Departments, among others.
According to reports this weekend, suspected Russian hackers targeted SolarWinds’ Orion business software with a “supply chain attack,” through which malicious code was embedded within a routine software update that was distributed to SolarWinds’ clients.
The Cybersecurity and Infrastructure Security Agency on Sunday issued an emergency directive noting that the breach “poses an unacceptable risk” and directing federal agencies to take steps to disconnect or shut down use of affected SolarWinds Orion products, among other things. SolarWinds also issued a security advisory to its users with more detailed instructions.
