On March 29, 2024, a software engineer named Andres Freund posted to a mailing list that he had found a back door in XZ Utils, a compression library so unremarkable that most engineers have never thought about it — and so ubiquitous that it sits inside virtually every Linux distribution on earth. He had found it because SSH logins on a test machine were taking about half a second longer than expected, and because he was the sort of person who investigates half a second.
What he uncovered, catalogued as CVE-2024-3094, was not an ordinary vulnerability. It was the endgame of a patient human operation. Beginning years earlier, an account operating as "Jia Tan" had contributed useful work to the XZ project, building genuine credibility. The project's sole maintainer — an unpaid volunteer, publicly struggling with burnout — came under sustained pressure from a chorus of other accounts demanding faster releases and urging that a co-maintainer be appointed. The helpful contributor was duly given commit rights. Then, in early 2024, malicious code was slipped in through obfuscated test files and a doctored build script, designed to hook into the authentication path of SSH on major distributions and grant its author remote access.
The timing is what makes the story permanent. The compromised versions had reached the testing branches of major distributions but had not yet landed in stable releases. Had it shipped, the operator would have held a skeleton key to a very large share of the world's internet-facing infrastructure — a compromise arguably without precedent in scale. It was stopped not by a scanner, an audit, or a vendor, but by one curious engineer benchmarking something unrelated on his own time.
The industry's uncomfortable takeaway had nothing to do with code. The attack targeted a maintainer's exhaustion. It exploited the fact that critical infrastructure for the entire digital economy is maintained, unpaid, by individuals who can be worn down and socially engineered — and that the open-source trust model has no defence against a contributor who spends two years being genuinely helpful first.
AT&T's 73 million records resurface
In late March, a dataset covering roughly 73 million current and former AT&T customers was released publicly on a criminal forum — data that had first been offered for sale years earlier and whose authenticity the company had previously disputed. This time analysis confirmed it, including encrypted passcodes that researchers demonstrated were trivially crackable, and AT&T reset affected account codes. The episode was a reminder that stolen data does not decay: a breach denied in 2021 can become a live consumer-security emergency in 2024, on a schedule chosen entirely by the people holding the files.
American healthcare still on paper
March was the second month of the Change Healthcare outage, and the sector's financial distress became acute: small practices and pharmacies, unable to submit claims or receive reimbursement, took emergency loans or drew down savings to keep paying staff. Federal agencies stepped in with flexibilities and advance-payment programmes. It was the clearest demonstration in years that a cyberattack's damage is often not the data theft but the interruption of money movement — and that when one clearinghouse handles a substantial share of a nation's medical claims, its outage is a public-health event.
Hathway, and 41 million subscribers
In March 2024, Indian internet service provider and cable operator Hathway suffered a breach reported to have exposed the personal data of more than 41 million customers, with roughly 200 GB of data taken after attackers exploited a critical flaw in the company's content management system. Names, addresses, Aadhaar-linked identity documents, and account details were among the material reported in the leak. Two things made it emblematic of India's 2024. First, the entry point was a web CMS — not an exotic exploit but the sort of internet-facing application that every large consumer business runs and few treat as critical. Second, the scale barely registered nationally: a breach of 41 million people passed with limited public reckoning, because there was still no regulator empowered to demand one.
⏳ Time capsule — March 2024
- "Jia Tan" entered the security lexicon as shorthand for a patient, human supply-chain operation.
- The internet briefly rallied to fund and support solo open-source maintainers — an enthusiasm that faded faster than the lesson.
- The EU's AI Act cleared its final parliamentary vote, beginning the world's first comprehensive AI rulebook.
- Pharmacies across the US were still handing patients paper claim forms, a month into the Change Healthcare outage.
The maintainer is the attack surface
XZ Utils permanently changed how the industry thinks about open-source risk. Funding and staffing for critical maintainer projects rose, provenance and reproducible-build efforts accelerated, and "who actually maintains this dependency, and are they okay?" became a legitimate due-diligence question. But the structural problem it exposed has not been solved: the software everything runs on is still, in many cases, maintained by a handful of volunteers with no institutional support. The npm worms of 2025 and the AI-toolchain compromises of 2026 in this archive are all descendants of the same insight — that the cheapest way into everything is through the person who maintains the smallest thing. We were lucky in March 2024. Luck is not a control.