RSA SecurID seed compromise

In March 2011, the security vendor RSA — the division of EMC whose SecurID tokens secured logins at banks, governments, and defense contractors worldwide — disclosed that it had been breached. The attackers had stolen information tied to the SecurID two-factor authentication system itself, undermining a product trusted by some 40 million token users to protect their most sensitive networks. Two months later, that stolen data surfaced in an intrusion attempt against Lockheed Martin.

What happened

The intrusion began with one of the most studied spear-phishing emails in security history. Attackers sent a small number of RSA employees a message with the subject line "2011 Recruitment Plan" and an attached Excel spreadsheet. The file carried an embedded Flash object exploiting CVE-2011-0609, a zero-day vulnerability in Adobe Flash Player.

When an employee — whose message had been pulled out of a junk folder — opened the attachment, the exploit installed a remote-access tool (a variant of Poison Ivy), giving the attackers a foothold inside RSA's network. They then moved laterally, harvested credentials, and escalated privileges, ultimately reaching systems holding data related to SecurID and exfiltrating it to external staging servers.

The SecurID problem

SecurID tokens generate a rotating numeric code derived from a secret "seed" value unique to each token, combined with the current time. If an attacker knows a token's seed, the code it displays becomes predictable — collapsing the second authentication factor. RSA never published exactly what was taken, but the breach was severe enough that RSA warned customers their SecurID protection was diminished and ultimately offered to replace tokens across its customer base.

Impact

• Data tied to the SecurID system — affecting an installed base of roughly 40 million tokens — was exfiltrated.
• In May 2011, Lockheed Martin detected and blocked an intrusion attempt that RSA confirmed was linked to the stolen SecurID information.
• Parent company EMC reported spending about $66 million in the quarter following the breach, largely on token replacement and monitoring.
• RSA characterized the intrusion as an Advanced Persistent Threat (APT) consistent with a nation-state actor.

Why it matters

The RSA breach is a foundational case study in two ideas now treated as doctrine. First, it showed that the security vendor is itself a high-value target — compromising the maker of an authentication product can undermine every downstream customer at once, a textbook supply-chain attack. Second, it demonstrated that two-factor authentication is only as trustworthy as the secrets behind it: a single phishing email, one zero-day, and patient lateral movement were enough to erode confidence in a product that millions relied on as a last line of defense. The episode accelerated industry moves toward phishing-resistant, public-key-based authentication.