SolarWinds Hack Grabs Senate Spotlight With CEO in the Hot Seat
(Bloomberg) -- The suspected Russian hackers who compromised software created by SolarWinds Corp. to break into American agencies and companies used a cyber weapon “so potentially powerful it could have been crippling,” according to Senator Mark Warner, chairman of the Senate Intelligence Committee.
Warner, a Democrat from Virginia, called the hacking campaign “a level of attack and level of penetration that is much greater than what we have seen” in previous cyber-attacks on the U.S. His comments came during a Monday interview with Bloomberg News, a day before executives from key technology companies, including SolarWinds, testify before his committee about the sprawling breach.
Warner’s committee will convene on Tuesday afternoon for the first public hearing on the attack, which was disclosed in December. It will hear testimony from Sudhakar Ramakrishna, the president and chief executive officer of SolarWinds, and Microsoft Corp. President Brad Smith, in addition to Crowdstrike Holdings Inc. CEO George Kurtz and Kevin Mandia, CEO of FireEye Inc. -- the firm that first detected and disclosed the cyber-attack in December.
While the attack appears to have been carried out for the purposes of espionage, Warner warned that the hackers had the capability to use the compromised software in a destructive manner, allowing them to “potentially shut down a number of these enterprises.”
The hackers who perpetrated the attack delivered malicious software updates to as many as 18,000 SolarWinds’s customers. Using this access, they broke into the networks at least nine federal agencies, including the departments of State, Treasury, Homeland Security, Commerce and Energy. In addition, approximately 100 private-sector companies were breached, according to the White House -- which is leading an ongoing investigation into the breach and has yet to determine its full scale.
The attackers exhibited sophistication and patience, SolarWinds’ Ramakrishna said in Monday remarks at a virtual conference hosted by the Center for Strategic and International Studies. The hackers practiced their techniques on older and less-scrutinized servers before installing malicious code in more current updates that were being actively downloaded by customers, he said.
For more articles like this, please visit us at bloomberg.com
Subscribe now to stay ahead with the most trusted business news source.
©2021 Bloomberg L.P.
