SolarWinds (2020)

SolarWinds was a supply-chain compromise discovered in December 2020 in which Russian SVR operators inserted the SUNBURST backdoor into the Orion network management software, which was then distributed to ~18,000 customer organizations including multiple U.S. federal agencies (Treasury, DHS, Commerce, State, Energy/NNSA), and technology companies including Microsoft and FireEye. The compromise was undetected for at least 9 months. Total recovery costs across affected organizations are estimated at $100B+ but precise figures remain disputed; the incident reshaped U.S. federal cybersecurity policy (Executive Order 14028, May 2021).