It seemed like nobody did, and the antivirus researcher mailing lists were buzzing with discussion about where to find the file.

The company said, 'Problem was, we didn’t have the file. The company said that the experts already knew in April about the email, but could not make a headway without the original file which was lost among millions of files with the security firm. Now, F-Secure claims that Timo Hirvonen, a security analyst working in its labs, has unravelled the modus operandi of the hackers after finding the original malware which attacked RSA. It said, 'Certain characteristics of the attack on RSA indicated that the perpetrator’s most likely motive was to obtain an element of security information that could be used to target defence secrets and related. The defence contractor said that it identified the breach quickly and prevented critical data theft, but later traced the breach to the hack attack on RSA in March. In May, the US-based fighter planes and spy satellites maker Lockheed Martin revealed that its database had been attacked by hackers. RSA also wrote on its blog that the attack was launched with a targeted email to EMC employees, and that the email contained an attachment called ‘2011 Recruitment plan.xls’. We remain convinced that customers who implement these steps can be confident in their continued security, and customers in all industries have given us positive feedback on our remediation steps.' 'We immediately published best practices and our prioritised remediation steps, and proactively reached out to thousands of customers to help them implement those steps. In an open letter to its customers, RSA wrote, 'On March 17, 2011, RSA publicly disclosed that it had detected a very sophisticated cyber attack on its systems, and that certain information related to the RSA SecurID product had been extracted.' The company had also warned that stolen IDs could be used by the hackers to launch a bigger attack on a client’s SecurID system. In March this year, EMC disclosed that hackers had stolen data from RSA in a 'very sophisticated attack'.

It is estimated that around 40 million SecurID tokens are in use across the world. Data storage company EMC owns RSA, which supplies coded security tokens - used for remote access to desktops - to millions of computer users across the world, including banks and defence companies.

Timo hirvonen f secure