On March 29, 2024, a software engineer named Andres Freund posted to a mailing list that he had found a back door in XZ Utils, a compression library so unremarkable that most engineers have never thought about it — and so ubiquitous that it sits inside virtually every Linux distribution on earth. He had found it because SSH logins on a test machine were taking about half a second longer than expected, and because he was the sort of person who investigates half a second.
What he uncovered, catalogued as CVE-2024-3094, was not an ordinary vulnerability. It was the endgame of a patient human operation. Beginning years earlier, an account operating as "Jia Tan" had contributed useful work to the XZ project, building genuine credibility. The project's sole maintainer — an unpaid volunteer, publicly struggling with burnout — came under sustained pressure from a chorus of other accounts demanding faster releases and urging that a co-maintainer be appointed. The helpful contributor was duly given commit rights. Then, in early 2024, malicious code was slipped in through obfuscated test files and a doctored build script, designed to hook into the authentication path of SSH on major distributions and grant its author remote access.
The timing is what makes the story permanent. The compromised versions had reached the testing branches of major distributions but had not yet landed in stable releases. Had it shipped, the operator would have held a skeleton key to a very large share of the world's internet-facing infrastructure — a compromise arguably without precedent in scale. It was stopped not by a scanner, an audit, or a vendor, but by one curious engineer benchmarking something unrelated on his own time.
The industry's uncomfortable takeaway had nothing to do with code. The attack targeted a maintainer's exhaustion. It exploited the fact that critical infrastructure for the entire digital economy is maintained, unpaid, by individuals who can be worn down and socially engineered — and that the open-source trust model has no defence against a contributor who spends two years being genuinely helpful first.
AT&T's 73 million records resurface
In late March, a dataset covering roughly 73 million current and former AT&T customers was released publicly on a criminal forum — data that had first been offered for sale years earlier and whose authenticity the company had previously disputed. This time analysis confirmed it, including encrypted passcodes that researchers demonstrated were trivially crackable, and AT&T reset affected account codes. The episode was a reminder that stolen data does not decay: a breach denied in 2021 can become a live consumer-security emergency in 2024, on a schedule chosen entirely by the people holding the files.
American healthcare still on paper
March was the second month of the Change Healthcare outage, and the sector's financial distress became acute: small practices and pharmacies, unable to submit claims or receive reimbursement, took emergency loans or drew down savings to keep paying staff. Federal agencies stepped in with flexibilities and advance-payment programmes. It was the clearest demonstration in years that a cyberattack's damage is often not the data theft but the interruption of money movement — and that when one clearinghouse handles a substantial share of a nation's medical claims, its outage is a public-health event.
Hathway, and 41 million subscribers
In March 2024, Indian internet service provider and cable operator Hathway suffered a breach reported to have exposed the personal data of more than 41 million customers, with roughly 200 GB of data taken after attackers exploited a critical flaw in the company's content management system. Names, addresses, Aadhaar-linked identity documents, and account details were among the material reported in the leak. Two things made it emblematic of India's 2024. First, the entry point was a web CMS — not an exotic exploit but the sort of internet-facing application that every large consumer business runs and few treat as critical. Second, the scale barely registered nationally: a breach of 41 million people passed with limited public reckoning, because there was still no regulator empowered to demand one.
Claude 3 arrives, and Blackwell follows
Anthropic announced the Claude 3 family on 4 March 2024 — Haiku, Sonnet and Opus in ascending order of capability — with Opus and Sonnet available that day and Haiku on 13 March. All three read images as well as text, and Anthropic's published evaluations placed Opus ahead of GPT-4 on most standard reasoning benchmarks, the first such claim the field took seriously. The rest of the month belonged to hardware and law. NVIDIA introduced Blackwell at GTC on 18 March: the B200 processor at 208 billion transistors, and a GB200 superchip pairing two of them with a Grace CPU, promised to partners for late 2024. xAI published the Grok-1 weights under an Apache 2.0 licence on 17 March, a 314-billion-parameter mixture-of-experts base checkpoint with no dialogue fine-tuning. On 13 March the European Parliament adopted the AI Act by 523 votes to 46. From 2026 the shape of the month is plain: Blackwell became the substrate the entire build-out waited on, and the Act became the text every other jurisdiction now argues with.
Four dollars an hour, and record quarters
On 13 March 2024 Microsoft confirmed that Copilot for Security would reach general availability worldwide on 1 April, priced not per seat or per device but by consumption — a Security Compute Unit at four dollars an hour — the first serious attempt to sell generative AI into the security operations centre at scale. The endpoint vendors were meanwhile posting the best numbers in their histories: CrowdStrike, reporting on 5 March, ended its fiscal year with annual recurring revenue of $3.44 billion, up 34%, and SentinelOne followed on 13 March at $724.4 million, up 39%. Cisco completed its $28 billion acquisition of Splunk on 18 March, the largest purchase in its four decades. The month then ended in an emergency, with CISA publishing its XZ Utils alert on 29 March and Red Hat telling users of its development branches to stop using affected instances immediately. The hindsight is unkind: four months later a faulty CrowdStrike content update crashed roughly 8.5 million Windows machines, on exactly the kernel-level access that record quarter had been sold on.
⏳ Time capsule — March 2024
- "Jia Tan" entered the security lexicon as shorthand for a patient, human supply-chain operation.
- The internet briefly rallied to fund and support solo open-source maintainers — an enthusiasm that faded faster than the lesson.
- The EU's AI Act cleared its final parliamentary vote, beginning the world's first comprehensive AI rulebook.
- Pharmacies across the US were still handing patients paper claim forms, a month into the Change Healthcare outage.
The maintainer is the attack surface
XZ Utils permanently changed how the industry thinks about open-source risk. Funding and staffing for critical maintainer projects rose, provenance and reproducible-build efforts accelerated, and "who actually maintains this dependency, and are they okay?" became a legitimate due-diligence question. But the structural problem it exposed has not been solved: the software everything runs on is still, in many cases, maintained by a handful of volunteers with no institutional support. The npm worms of 2025 and the AI-toolchain compromises of 2026 in this archive are all descendants of the same insight — that the cheapest way into everything is through the person who maintains the smallest thing. We were lucky in March 2024. Luck is not a control.