The number of SolarWinds customers targeted and impacted by last year’s massive hack is far less than previously reported.

That’s according to Sudhakar Ramakrishna, SolarWinds’ president and CEO. In a blog, he said his company is close to completing its investigation of the hack.

Early on, SolarWinds reported up to 18,000 customers could have been vulnerable to Sunburst. That’s the malicious code used by the cyberattackers. It now says fewer than 100 SolarWinds customers were hacked through Sunburst.

SolarWinds’ Sudhakar Ramakrishna

“Based on our investigations and conversations with our customers, we believe the number of customers targeted and impacted by the Sunburst malicious code is significantly fewer than the number of potentially vulnerable customers,” Ramakrishna said. “This information is consistent with estimates provided by U.S. government entities and other researchers, and consistent with the presumption the attack was highly targeted.”

New Findings

During its investigation, SolarWinds also discovered the following:

“While we don’t know precisely when or how the threat actor first gained access to our environment, our investigations have uncovered evidence that the threat actor compromised credentials, and conducted research and surveillance in furtherance of its objectives through persistent access to our software development environment and internal systems, including our Microsoft Office 365 environment, for at least nine months prior to initiating the test run in October 2019,” Ramakrishna said. “Based on our learnings, while unfortunate, it’s not uncommon for threat actors to be in target environments for several months to years. This further reinforces the need for transparency and collaboration, so we can all benefit from one another’s shared experiences and knowledge.”

SolarWinds said the three most likely candidates for initial entry include zero-day vulnerability in a third-party application or device; brute-force, such as a password spray attack; or social engineering, such as a targeted phishing attack.

Information Exfiltration

SolarWinds also believes the malicious hacker took certain information as part of its research and surveillance. This evidence includes the following:

“Armed with what we’ve learned about this attack, we’re focused on becoming an industry leader in protecting our software development from cyber intrusions,” Ramakrishna said. “We’re working with industry experts to implement enhanced security practices designed to further strengthen and protect our products and environment against these and other types of attacks in the future.”