Anatomy of a Breach: 2020 Year in Review — SolarWinds, COVID-19, and the Year the Supply Chain Broke

2020: SolarWinds. COVID-19. Ransomware kills. The year the supply chain broke.

On 13 December 2020, cybersecurity firm FireEye disclosed that it had been breached by a sophisticated nation-state actor. The investigation revealed the attack vector: a poisoned software update to SolarWinds Orion, a network monitoring platform used by approximately 33,000 customers including virtually every US government agency. The compromised update — containing a backdoor dubbed 'Sunburst' — had been distributed to approximately 18,000 organisations between March and June 2020. The attackers, attributed to Russia's SVR intelligence service, had spent nine months inside some of the world's most sensitive networks — including the US Departments of the Treasury, Commerce, Homeland Security, State, and Energy, as well as private companies including Microsoft, Intel, and Deloitte.

SolarWinds was the supply chain attack that NotPetya had foreshadowed — but more sophisticated, more targeted, and more patient. Where NotPetya was destructive and indiscriminate, Sunburst was stealthy and selective. The attackers used the initial access provided by the backdoored update to identify high-value targets and then deployed additional tools only against selected networks. The attack had been active since March 2020 — nine months of undetected access to the world's most sensitive networks.

Twelve months. A pandemic. A death. A supply chain catastrophe.

The trusted update was the attack.

SolarWinds represented the culmination of every supply chain attack documented in this series — from RSA SecurID (2011) through Target's HVAC vendor (2013), NotPetya's M.E.Doc update (2017), Ticketmaster's chatbot script (2018), and Blackbaud's charity data (2020). But SolarWinds was different in scale (18,000 organisations), sophistication (the backdoor was embedded in a legitimately signed software update from a trusted vendor), stealth (nine months of undetected access), and impact (US government agencies compromised). The software supply chain — the mechanism designed to keep you secure — had become the most dangerous attack vector.

144 articles. 2009 to 2020. The threats are existential. The controls are unchanged. Act now.

With 144 articles spanning twelve years, this series has documented the complete arc from lost CDs to nation-state supply chain attacks, from £1,000 ICO fines to hundreds of millions in GDPR penalties, from data theft to ransomware that kills. The controls remain the same: penetration testing, Cyber Essentials certification, SOC in a Box monitoring, and incident response capability. Twelve years of evidence. One conclusion. The organisations that implement these controls survive. The rest fill these pages.

Related Articles