“[These attackers] are weaponizing market share and scale against a software provider,” Mr. Pollard said. “That’s incredibly concerning.”
Some computer systems at the Commerce and Treasury departments, as well as the Department of Homeland Security, were compromised as a result of the attack. SolarWinds lists many additional customers on its website 425 of the Fortune 500 companies and additional U.S. agencies but it is unclear how many and which have been affected.
Mr. Pollard said such reach can allow attackers to hit multiple targets through a single entry point.
“While there’s a lot of advantages of centralizing from a procurement perspective, you have to wonder if you concentrated too much risk in the U.S. government,” he said. “You’re not going to put the president and vice president on the same flight.”