On March 17, 2011, RSA Security published a letter from executive chairman Art Coviello on its website. The letter was short, deliberately vague, and alarming in its implications. RSA had suffered a data breach. The breach involved information "related to RSA's SecurID two-factor authentication products." Coviello acknowledged that the stolen information "could potentially be used to reduce the effectiveness of a current two-factor authentication implementation."

RSA SecurID tokens were used by approximately 40 million people at 30,000 organizations including the US Department of Defense, major defense contractors, and financial institutions. The seed values - the secret numbers programmed into each token that allowed it to generate the correct one-time code - had been stolen. The world's most widely deployed two-factor authentication system had been compromised at its cryptographic root.

The Attack

The breach began with a phishing email sent to a small number of RSA employees in March 2011. The email's subject line was "2011 Recruitment Plan" and it carried an Excel spreadsheet as an attachment. The spreadsheet contained a zero-day exploit for Adobe Flash (CVE-2011-0609) embedded in an Excel file. When opened, it silently installed a backdoor - a variant of the Poison Ivy remote access tool.

From the initial foothold, the attackers performed standard lateral movement: dumping credentials, moving to higher-privilege systems, pivoting to servers rather than workstations. RSA's security operations center detected unusual network activity about a month after the initial compromise. By then, the attackers had accessed and exfiltrated data from the production systems where SecurID seed databases were stored.

[TECHNICAL NOTE]
RSA SecurID tokens work by sharing a seed value between the token and the authentication server. Both use the same algorithm and the same seed to generate a time-synchronized six-digit code that changes every 30 or 60 seconds. An attacker who knows a specific token's seed value can predict its current code without physically possessing the token. With the seed database, an attacker who also knew a user's PIN (the static half of two-factor authentication) could bypass SecurID entirely. The seed theft did not automatically compromise all tokens - it required either knowing users' PINs or separately compromising username/password pairs.

The Lockheed Martin Connection

For two months after RSA's disclosure, the implications were theoretical. In May 2011, Lockheed Martin detected an intrusion attempt and activated its incident response. The attackers had used cloned SecurID tokens - reproduced from the stolen seed data - to defeat Lockheed's two-factor authentication. Lockheed's security team detected the intrusion quickly and contained it. Two other defense contractors, L-3 Communications and Northrop Grumman, also reported SecurID-related intrusion attempts around the same time.

The Lockheed incident confirmed the worst case scenario: the stolen RSA data was being actively used to attack defense contractors. RSA responded by offering to replace tokens for high-risk customers and providing additional monitoring tools. The US government accelerated its own review of SecurID-dependent systems.

Attribution to China

Attribution for the RSA breach was contested but pointed toward Chinese state-sponsored actors - specifically, the same groups responsible for Operation Aurora and other intrusions targeting US defense and technology companies. The Poison Ivy RAT was commonly used by Chinese APT groups. The targeting of defense contractor authentication infrastructure fit the profile of an intelligence operation seeking persistent access rather than a financially motivated crime.

The attack chain - compromise authentication provider to then attack defense contractors - represented a new category of supply chain attack: not compromising software or hardware delivered to the target, but compromising the security infrastructure the target relied on. RSA was not the ultimate target. RSA was the key that opened the actual targets.

[WARNING]
RSA's initial disclosure was widely criticized as insufficient. The company did not disclose exactly what had been stolen for months. Customers deploying SecurID for high-value access did not know whether their specific token deployment was at risk, because they did not know whether their seed values had been included in the exfiltration. The incident became a case study in breach disclosure: a vendor had the information customers needed to assess their own risk and make remediation decisions, but withheld it. RSA's legal exposure and competitive concerns created incentives that directly conflicted with customers' security interests.

The $66 Million Cost and Long-Term Impact

RSA's parent company EMC disclosed in its 2011 annual report that the breach response cost approximately $66 million - covering token replacement, customer remediation, security improvements, and additional monitoring. The reputational cost was harder to quantify but significant. RSA SecurID's competitive position as the dominant enterprise two-factor solution was permanently weakened.

The breach accelerated several industry trends. FIDO (Fast Identity Online) Alliance was founded in 2012, developing phishing-resistant authentication standards - hardware security keys - that eliminated the seed-sharing architecture that made SecurID vulnerable. The recognition that shared secrets at scale are a single point of compromise drove the industry toward public-key cryptography for authentication, culminating in the passkey standards of the 2020s.

The RSA breach also established the template for supply chain attacks on security infrastructure. If you cannot compromise the target directly, compromise the tools the target depends on to defend itself. This logic appeared subsequently in the SolarWinds campaign (compromise the monitoring software), the Kaseya attack (compromise the managed service provider platform), and numerous attacks on certificate authorities and code signing infrastructure. The security industry's own products became the attack surface.