The security company hacked through a spreadsheet

The story

RSA made SecurID tokens: small devices on keychains that show a new six-digit code every minute. Banks, governments and defense companies used them as a second step at sign-in.

In March 2011, RSA announced it had been the victim of “an extremely sophisticated cyber attack.” The way in was not sophisticated. Two small groups of employees received an email with a spreadsheet attached, titled “2011 Recruitment plan.” One employee retrieved it from the junk mail folder and opened it. The file used a flaw in Adobe Flash to install a remote control program.

From there the attackers moved through RSA’s network and stole information related to SecurID. RSA did not say exactly what was taken, but it later offered to replace tokens for many customers. In May, the defense company Lockheed Martin reported an attempted attack on its own network that used stolen SecurID information.

Why it mattered

The breach showed that attackers may go after a security supplier to reach that supplier’s customers. If the secret behind a sign-in device is stolen, every organization that relies on it is exposed at once. A security product is only as strong as the company that makes it.

The lesson today

Even a security company was exposed by one person opening an attachment from the junk folder. Email filters catch a lot, and people still go looking for messages that seem important. Training helps people recognize the bait, and protection on the computer catches what gets past them.