No doubt the company claims to take security seriously. It promises to secure customers' IT infrastructure by bundling in the company's network security products. Orion is Solarwinds' one-stop shop for IT software. But this latest news - delivered by Zack Whittaker - adds another layer of irony to the ongoing debacle. The fallout from this hacking - which may have begun as early as March of this year - will continue for a long, long time. CISA itself was compromised by the hack, something acknowledged by the DHS less than 24 hours after its dire directive was issued. Unfortunately, the directive from CISA was delivered a bit too late. It has memory-holed its 'Customer' page during this trying time.) The company boasts 300,000 customers, among them several government agencies and all five branches of the military. It was limited, but only if you consider 18-33,000 potential infections 'limited.' It's only a small percentage because Solarwinds's customer base is so large. Meanwhile, SolarWinds filed an update with the SEC detailing the extent of the damage.

The attack was so widespread and potentially catastrophic, the DHS's cyber wing issued an emergency directive that stated the only way to mitigate damage was to airgap devices and uninstall affected Orion software.

The hackers - presumed to be operating on behalf of the Russian government - deployed tainted updates (served up by SolarWinds) that gave them backdoors to snoop on internal communications and exfiltrate sensitive data. As was noted here earlier, up to 18,000 customers of globally-dominant network infrastructure vendor SolarWinds may have been compromised by malicious hackers.

Orion solarwinds database lock