Case Studies: Historical Grid
The CCleaner Attack (2017)
A Trusted Update, Turned Trojan: When 2.27 Million Users Downloaded Malware Signed by the Vendor Itself
In September 2017, investigators discovered that attackers had compromised the build environment of Piriform's CCleaner — a wildly popular PC-cleanup utility — and slipped a backdoor into official, digitally signed releases downloaded by roughly 2.27 million users. Forensics revealed a second-stage payload that activated only on a hand-picked list of technology and telecom firms, marking the incident as a targeted espionage play riding a trusted software updater. The investigation, which had to pull apart a legitimately signed binary to find the malice inside, is the direct ancestor of this week's FakeGit operation — the same abuse of trusted distribution, now scaled to thousands of repositories and the AI agents that fetch them.
The 3CX Cascade (2023)
A Supply Chain Inside a Supply Chain: The First Documented Double-Compromise, Traced to a Poisoned Trading App
In March 2023, the 3CX desktop phone app began shipping a trojanized build to its enterprise customers — but the extraordinary finding came when responders traced the root cause backward and discovered 3CX had itself been breached through a separate poisoned installer, the X_TRADER trading application, attributed to North Korea's Lazarus Group. It was the first publicly documented instance of one software supply-chain attack seeding another, forcing investigators to reason about nested chains of trust. That same cascading abuse — trust borrowed, then borrowed again — is exactly what FakeGit exploits when a poisoned MCP package rides a developer's trust straight into an AI agent's execution.
The Adobe Breach (2013)
153 Million Passwords and the Source Code Too: The Breach That Leaked Both a Company's Users and Its Software
In late 2013, Adobe disclosed a breach that ultimately exposed around 153 million user records — email addresses, poorly encrypted passwords, and unencrypted password hints — alongside the theft of source code for flagship products including ColdFusion and Acrobat. Investigators faced a double forensic problem: the credential dump seeded years of password-reuse attacks once cryptographers cracked the weak ECB-encrypted passwords, while the stolen source code handed adversaries a map to hunt for future zero-days. It is a reminder that trust in a vendor's own code can be turned against everyone downstream — the theme this week's HSIN and FakeGit investigations carry from stolen source into poisoned repositories.
The Anthem Breach (2015)
One Stolen Login, 78.8 Million Records: How a Single Credential Opened a Health Insurer's Data Warehouse
Disclosed in February 2015, the Anthem breach exposed the personal data of 78.8 million people after a spear-phishing email harvested a single administrator's credentials, which attackers used to burrow into the insurer's data warehouse and exfiltrate records over weeks. The investigation — attributed to a China-linked espionage group — became a landmark study in how one trusted, privileged login becomes the keys to an entire kingdom, and in reconstructing slow exfiltration from data-warehouse logs. Its weeks-long undetected dwell time prefigures exactly the five-to-six-week gap DHS is now reconstructing inside the trusted HSIN network on Page 1.
— Page 2 —