Updated added to the end of the article.
Cisco has confirmed to BleepingComputer that it is investigating recent claims that it suffered a breach after a threat actor began selling allegedly stolen data on a hacking forum.
“Cisco is aware of reports that an actor is alleging to have gained access to certain Cisco-related files,” a Cisco spokesperson told BleepingComputer.
“We have launched an investigation to assess this claim, and our investigation is ongoing.”
This statement comes after a well-known threat actor named “IntelBroker” said that he and two others called “EnergyWeaponUser and “zjj” breached Cisco on October 6, 2024, and stole a large amount of developer data from the company.
“Compromised data: Github projects, Gitlab Projects, SonarQube projects, Source code, hard coded credentials, Certificates, Customer SRCs, Cisco Confidential Documents, Jira tickets, API tokens, AWS Private buckets, Cisco Technology SRCs, Docker Builds, Azure Storage buckets, Private & Public keys, SSL Certificates, Cisco Premium Products & More!,” reads the post to a hacking forum.
IntelBroker also shared samples of the alleged stolen data, including a database, customer information, various customer documentation, and screenshots of customer management portals.
However, the threat actor did not provide further details about how the data was obtained.
In June, IntelBroker began selling or leaking data from numerous companies, including T-Mobile, AMD, and Apple. Sources familiar with the attack told BleepingComputer it was stolen from a third-party managed services provider for DevOps and software development.
It is unknown if the Cisco breach is related to these June breaches.
BleepingComputer again contacted this third-party vendor to confirm if they suffered a cyberattack but has not received a reply.
Update 10/16/24: Cisco says that they are continuing to investigate the reports but have found no evidence their systems were breached.
“Cisco is investigating reports that an unauthorized actor is alleging to have gained access to certain Cisco data and data of our customers,” Cisco told BleepingComputer.
“Cisco takes this allegation seriously and we have engaged law enforcement as part of this investigation.”
“To date, our investigation has found no evidence of our systems being impacted. We will notify customers where we confirm that the actor has obtained their confidential information.”
