Anatomy of a Breach

Anatomy of a Breach: RSA SecurID — The Attack That Compromised the World's Authentication Tokens

> series: anatomy_of_a_breach —— part: 026 —— target: rsa_security —— stolen: securid_token_seeds —— tokens_replaced: 40,000,000<span class="cursor-blink">_</span>_

Hedgehog Security 28 February 2011 14 min read

They stole the seeds. Every token was compromised.

On 17 March 2011, RSA Security — the EMC subsidiary responsible for the SecurID two-factor authentication token used by tens of thousands of organisations worldwide, including military and intelligence agencies — disclosed that it had suffered an 'extremely sophisticated cyber attack' that had extracted information related to its SecurID products. The stolen data included the 'seeds' — the secret values used to generate the one-time codes displayed on each token. If the seeds were compromised, an attacker who also knew a user's PIN could impersonate any SecurID-protected login.

The breach sent shockwaves through the defence and intelligence communities. SecurID tokens were the primary second factor for VPN access to some of the most sensitive networks in the world, including those of US defence contractors Lockheed Martin, Northrop Grumman, and L-3 Communications. Within weeks, attackers would use the stolen RSA data to breach Lockheed Martin's network — confirming that the RSA compromise was not an end in itself but a means to a larger objective. RSA ultimately replaced approximately 40 million SecurID tokens at an estimated cost of $66 million.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

A phishing email that compromised global authentication.

The RSA breach began with a phishing email. An employee at RSA received an email with the subject line '2011 Recruitment Plan' containing an Excel spreadsheet with an embedded Adobe Flash zero-day exploit (CVE-2011-0609). When the employee opened the attachment, the exploit installed a backdoor — a variant of the Poison Ivy remote access trojan — giving the attackers a foothold inside RSA's network.

RSA SecurID Breach — Kill Chain
── Initial Access ──────────────────────────────────────────
Spear-phishing email: '2011 Recruitment Plan'
Excel attachment with embedded Flash zero-day
Poison Ivy RAT installed on employee workstation

── Lateral Movement ────────────────────────────────────────
Credential harvesting from compromised workstation
Escalation to accounts with access to sensitive systems
Movement toward SecurID seed database infrastructure

── Exfiltration ────────────────────────────────────────────
SecurID token seeds extracted
Data staged on compromised internal servers
Exfiltrated via encrypted channels to attacker infrastructure

── Impact ─────────────────────────────────────────────────
Every SecurID token in deployment potentially compromised
Defence contractors breached using stolen token data
40 million tokens replaced at ~$66 million cost

One phishing email. Thousands of organisations compromised.

The RSA breach is the definitive supply chain attack case study. The attackers did not target Lockheed Martin, Northrop Grumman, or L-3 Communications directly — they targeted RSA, the vendor that supplied the authentication technology those organisations depended on. By compromising the supplier, they compromised every customer. This is the same supply chain pattern we documented in the Network Solutions breach and that defines modern attacks like SolarWinds (2020) and MOVEit (2023).

One Phishing Email Started Everything
The entire breach — compromising the authentication infrastructure of thousands of organisations worldwide — began with a single employee opening a malicious Excel attachment. Our <a href="/penetration-testing/social-engineering">social engineering assessments</a> test whether your staff would open that email. Because the lesson of RSA is that your entire security posture can depend on one click.
Supply Chain Trust Is Fragile
Organisations trusted RSA SecurID as their second factor. When RSA was compromised, that trust was invalidated overnight. Every organisation's security depends on its supply chain — and our <a href="/blog/sector-under-the-microscope-defence-supply-chain">defence supply chain analysis</a> examines why this risk persists.
MFA Must Be Resilient
The RSA breach compromised a specific MFA implementation — hardware tokens with shared seeds. Modern alternatives like FIDO2/WebAuthn and passkeys — which <a href="/cyber-essentials">Cyber Essentials Danzell</a> now accepts — use asymmetric cryptography that eliminates the single-point-of-failure seed database. The RSA breach accelerated the move toward more resilient authentication architectures.
Detection Required Months
RSA detected the breach relatively quickly by 2011 standards, but the attackers still had time to exfiltrate the seed data. <a href="https://www.socinabox.co.uk">SOC in a Box</a> provides 24/7 monitoring that detects the lateral movement, credential harvesting, and data staging that precede exfiltration — reducing dwell time from weeks to hours.

Supply chain attacks have only accelerated.

The RSA breach was a harbinger. SolarWinds (2020), Kaseya (2021), MOVEit (2023), and the ongoing cascade of supply chain compromises all follow the same pattern: compromise the vendor, compromise the customers. For organisations in the defence supply chain and regulated sectors, supply chain security is no longer optional — it is a fundamental component of the threat model.

Our penetration testing assesses your organisation's own security posture. Cyber Essentials Plus certification demonstrates that your security controls meet the baseline expected by your customers. SOC in a Box monitors for the indicators of supply chain compromise — anomalous authentication patterns, unexpected data flows, and credential harvesting. And UK Cyber Defence provides incident response when a supply chain breach affects your organisation.


Your security vendor was hacked. Now what?

The RSA breach proved that supply chain compromise can invalidate your security controls overnight. Our <a href="/penetration-testing">penetration testing</a> validates your own defences. <a href="/cyber-essentials">Cyber Essentials</a> certifies your baseline. And <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects when something in your supply chain goes wrong.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles