History and stories
Operation Aurora: when Google said it had been hacked
It was unusual for a large company to say publicly that it had been breached. Google did, and named the attack.
1 min readStory
The short version
In January 2010, Google announced it had been targeted by attackers who also went after dozens of other companies, starting with a single link sent to employees.
The story
On January 12, 2010, Google published a blog post saying it had been the target of a sophisticated attack from China in late 2009. At least twenty other large companies had been targeted too. Adobe, Juniper Networks, Rackspace and Akamai later confirmed they were among them.
The attacks began with carefully chosen employees. They received messages with links that, when opened, used an unknown flaw in Internet Explorer to install malware quietly. From those computers, the attackers moved further into the companies’ networks. Their main goal appeared to be source code: the programs the companies had built.
The security company McAfee named it Operation Aurora, after a word found in the malware’s file paths.
What changed afterward
Google’s decision to go public changed expectations. Companies began to accept that well-funded attackers could get into almost anyone, and that the question was how fast they would be found. Google later moved toward a model where no device is trusted just because it is inside the office network.
The lesson today
The way in was an ordinary person opening a link. Even the best-defended companies have people who can be tricked. Watching what happens on computers after a click, and limiting how far one computer can reach, matters as much as stopping the click.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.