If that were true, here's how an attack might work.

Attackers appear to have gained access to RSA's database of seed numbers, called "token records" in RSA parlance. These numbers are essentially the building blocks used to create the six-digit log-in numbers that RSA tokens generate every sixty seconds or so. The tokens are widely used by governments, contractors and banks to add a second layer of security alongside computer passwords.

With a seed number in hand, a technically savvy hacker could figure out what log-in number a SecurID token would generate at any given time. The trick, however, would be to figure out which particular token a victim was using. That's not obvious. RSA says it has shipped about 40 million tokens, so it would take some work to link a particular seed number to a particular user's SecurID token.

A criminal might be able to achieve this by posing as a network administrator and emailing a victim, telling them to visit a Web site and to log in with their password and SecurID login number. With just a couple of successive log-ins, hackers could figure out which of the millions of seed numbers was used to generate the log-in numbers. Or they could identify the seed numbers by asking victims to enter their tokens' serial numbers, say as part of a security audit, and then look that serial number up in their stolen database.

Whether all RSA customers need to worry about this type of attack is unclear. It may be that whoever hacked the company was only looking for seed numbers associated with a particular customer -- Lockheed Martin, for example. It could also be the case that the hacker is about to publish all of the seed numbers on a public website, sending all SecurID customers scrambling for cover. It may be that RSA doesn't actually know how much data was taken.