> It's taken this long for the RSA Lawyers to allow a public statement
Fixed that for you. Customers were notified and I believe many a secureid token was replaced, at least for all mission critical businesses.
That letter to the public would have been second to the priority of customer notifications, even sony was late in their press release -- carefully wording their response to forgo accepting blame. Since the attack was "thwarted" we can assume that RSA did in fact communicate with these businesses and shared the knowledge of the potential attack.
It's not a "serious problem" like if the fundamental cryptology is flawed or implemented with a level of security through obscurity. The only "serious problem" was storing seeds for some unknown reason. If your seed wasn't stored then you have nothing to worry about, and I can only assume if you were contacted by someone from RSA(personally) than you should probably assume your seed was stored.
One would hope that a business like Lockheed Martin then setup a honey pot to try and gather information on the attackers logging in with these compromised SecureIDs.
> The only "serious problem" was storing seeds for some unknown reason.
I read somewhere else that the seeds are stored by RSA as an additional backup for the customers. In the event that the customer accidentally loses their seed database, it would be a very costly operation to replace all the SecurID hardware tokens.
But... well... they are forced to replace all the SecurID hardware tokens anyway.
> In the event that the customer accidentally loses their seed database, it would be a very costly operation to replace all the SecurID hardware tokens.
It'd be a very profitable operation for RSA, so I doubt this explanation.
