INCIDENT REPORT · CP-2020-001

SolarWinds Orion supply chain compromise

L3 · ELEVATEDCONFIRMED

A state-sponsored actor compromised the build system of SolarWinds' Orion IT monitoring software. Trojanized updates then gave the actor access to government and private networks from at least March 2020.

Incident ID: CP-2020-001
Disclosure date: 13 DEC 2020
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Austin, United States (Affected software vendor headquarters (SolarWinds))
Threat classification: Level 3 — ELEVATED
Classification rationale: Broad espionage compromise of government and corporate networks via a trusted supply chain; no demonstrated disruption of essential services, so held at Level 3 rather than 4.
Attack type: Supply-Chain Attack
Nature: Malicious activity
Attack vector: Malicious code inserted into SolarWinds Orion software updates released March–June 2020 via a compromise of the Orion build system; also abuse of authentication mechanisms
Sectors: Government, Technology, Energy, Telecommunications
Critical infrastructure: Yes
Organizations affected: SolarWinds, US federal civilian agencies, Private sector organizations
Operational consequences: SolarWinds estimated that fewer than 18,000 customers installed affected Orion versions. CISA Emergency Directive 21-01 ordered federal agencies to disconnect or power down affected products.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the US government (White House, 15 April 2021) to Russia's Foreign Intelligence Service (SVR)

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

SolarWinds Orion supply chain compromise

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2020-001

Disclosure date

13 DEC 2020

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Austin, United States (Affected software vendor headquarters (SolarWinds))

Threat classification

Level 3 — ELEVATED

Classification rationale

Broad espionage compromise of government and corporate networks via a trusted supply chain; no demonstrated disruption of essential services, so held at Level 3 rather than 4.

Attack type

Supply-Chain Attack

Nature

Malicious activity

Attack vector

Malicious code inserted into SolarWinds Orion software updates released March–June 2020 via a compromise of the Orion build system; also abuse of authentication mechanisms

Sectors

Government, Technology, Energy, Telecommunications

Critical infrastructure

Yes

Organizations affected

SolarWinds, US federal civilian agencies, Private sector organizations

Operational consequences

SolarWinds estimated that fewer than 18,000 customers installed affected Orion versions. CISA Emergency Directive 21-01 ordered federal agencies to disconnect or power down affected products.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the US government (White House, 15 April 2021) to Russia's Foreign Intelligence Service (SVR)