White House Says 100 Private Sector Orgs Hit in SolarWinds Campaign

A top White House cybersecurity official said in a press briefing today that the massive SolarWinds cyberattack campaign's scope and scale make it "more than an isolated case of cyber espionage."

Anne Neuberger, deputy national security advisor for cyber and emerging technology, confirmed that so far nine federal agencies and 100 private industry organizations have been compromised in the attacks. In addition, the attackers waged the attack from inside the US, making it difficult for the US government to "observe their activity," she said.

The attackers, which she described as "likely of Russian origin," focused on the identity part of the network, which makes it harder to remediate. US intelligence agencies previously had cited Russia as the possible perpetrator.

"We believe it took them months to plan and execute," Neuberger said, and it will take months for the US government to investigate fully. 

The Biden administration will be taking executive action in response to the "gaps" that were exploited in the incident, she said. A "holistic" response to the perpetrators is under discussion.

"This isn't the only case of cyber activity of malicious Russian origin," Neuberger said.

See her briefing here.