Key points
- Tainted code was found in three product versions shipped between February and June 2020.
- The malware bypassed source code control, entering via the build supply chain instead.
- Approximately 18,000 customers downloaded the compromised software updates.
The short version
- Former SolarWinds CISO Tim Brown confirmed the attack did not involve source code repositories.
- The compromised builds were distributed to 18,000 customers before detection.
- The incident impacted critical infrastructure, including power grids and military systems.
The details
Former SolarWinds CISO Tim Brown, speaking at JFrog’s swampUP 2026 conference, detailed the mechanics of the 2020 Sunburst breach. On December 12, 2020, Brown received notification from his CEO that Mandiant had called to report tainted code was being exploited. An internal investigation revealed the malicious code was absent from source code control but present in three product versions produced between February and June 2020. Sales and support teams determined 18,000 customers had downloaded these specific versions.
Brown categorized the incident as a “build supply chain attack” because the contamination occurred during the product build process rather than in the source repository. He noted that SolarWinds software was embedded in critical sectors, including power grids, nuclear facilities, and military operations, with 499 of the Fortune 500 companies affected. The widespread deployment meant the payload could have been whatever it wanted to be.
The context
Brown stated that the first four years at SolarWinds passed without major incidents. The breach was told to go public on Sunday, following the initial call on December 12. Brown described the event as a wake-up call for the industry, noting the unprecedented scale compared to typical product vulnerabilities. He relied on legal counsel DLA Piper to coordinate crisis management, hiring CrowdStrike, KPMG, and Krebs Stamos for the investigation.
What should you do?
- Review software update histories for builds released between February and June 2020.
- Verify that source code controls were not bypassed during the build process.
- Monitor for unauthorized changes in production environments that originate from build pipelines.
- Ensure incident response plans cover supply chain compromises, not just direct breaches.
For customers and users
Organizations should audit their software inventory to identify installations from the affected time window. Teams usually check build logs for anomalies that indicate unauthorized modifications during compilation. Verify that all dependencies are signed and that build environments are isolated from general network traffic. Watch for phishing attempts that reference this specific breach to harvest credentials. Ensure that multi-factor authentication is enabled on all administrative accounts to mitigate lateral movement risks.
What to do and how to stay safe: SolarWinds
- Audit build pipelines for integrity checks that verify code has not been altered post-commit.
- Implement strict segregation between development, build, and production environments.
- Monitor for unusual outbound traffic from software update servers or build agents.
- Review access logs for build servers to identify unauthorized access during the relevant period.
Step-by-step guide: Identity Theft Risks and Low-Cost Protections for Small Teams
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Sunburst attack originate in the source code repository?
No, according to Tim Brown, the tainted code was not in source code control but entered during the build process.
How many customers were affected by the compromised updates?
Approximately 18,000 customers downloaded the versions containing the tainted code.
What sectors were impacted by the breach?
The breach affected power grids, nuclear facilities, military systems, and 499 of the Fortune 500 companies.
