One CDNetworks breach tampered with four customers' files

Most distribution compromises in this archive begin at the vendor. This one did not. In May 2014 the content-delivery provider CDNetworks was entered directly on the servers customers used to upload what it would serve, and files belonging to several unrelated companies were altered in the same intrusion.

The customers had nothing in common except their supplier. Buffalo's Windows driver, firmware, and utility installers were replaced with builds that dropped a Japanese online-banking trojan. Aiming's update files for the online game Blade Chronicle were swapped for malware. GMO Pepabo's JUGEM blog content, H.I.S. via Recruit Marketing Partners, and other customer pages were tampered with in the same window. None of them had been breached; their supplier had.

CDNetworks disclosed on June 3 and concluded that the cause was on its own side, describing direct logins to the content-upload service most likely from a compromised internal terminal. It published a progress report on June 11 and a final report on June 27, and completed removal of the altered files by June 3.

The record exists because the individual incidents read as separate vendor failures unless the shared root cause is stated. Buffalo's own customers experienced it as Buffalo serving malware; the download server was CDNetworks', operated under contract, and one intrusion there reached every company whose content passed through it.