Security giant RSA said a sophisticated attack has possiblycompromised the two-factor authentication system used by tens ofmillions of end users of the company's clients, which includeslarge banks and other corporations and credit unions.

RSA, a division of EMC, placed the attack in the AdvancedPersistent Threat category, which typically means the attackers hadundetected access to sensitive data for some period of time.

RSA's executive chairman, Art Coviello, said the company hasfound that information “specifically related” to its widely usedSecurID two-factor authentication products was involved.

“While at this time we are confident that the informationextracted does not enable a successful direct attack on any of ourRSA SecurID customers, this information could potentially be usedto reduce the effectiveness of a current two-factor authenticationimplementation as part of a broader attack,” Coviello said in anopen letter posted on the company's website at www.rsa.com.

He called the attack extremely sophisticated and said thecompany is working with authorities and contacting clients.

“We are committed to applying all necessary resources to giveour SecurID customers the tools, processes and support they requireto strengthen the security of their IT systems in the face of thisincident. Our full support will include a range of RSA and EMCinternal resources as well as close engagement with our partnerecosystems and our customers' relevant partners,” Coviellosaid.