Cisco is investigating claims that a group of hackers, led by the threat actor IntelBroker, breached its systems and stole sensitive developer data, which is now being sold on a hacker forum. The company confirmed to BleepingComputer that it is aware of the situation and has launched an ongoing investigation into the matter.
IntelBroker, along with collaborators “EnergyWeaponUser” and “zjj,” alleged in a forum post that they successfully breached Cisco on October 6, 2024, and obtained a significant amount of sensitive data. The data reportedly includes files from GitHub, GitLab, and SonarQube projects, source code, hard-coded credentials, certificates, customer documentation, API tokens, AWS and Azure storage buckets, and SSL certificates.
As evidence of their claims, the hackers shared samples of the stolen data, including databases, customer information, and screenshots of customer management portals. However, they have not disclosed how they gained access to Cisco’s systems.
Cisco’s spokesperson responded, “Cisco is aware of reports that an actor is alleging to have gained access to certain Cisco-related files. We have launched an ongoing investigation to assess this claim.”
IntelBroker is a known figure in the cybercrime world, having been involved in previous data breaches, including attacks on T-Mobile, AMD, and Apple earlier in 2024. In those incidents, the stolen data was reportedly obtained through a third-party managed services provider for DevOps and software development. However, it is unclear if the alleged breach at Cisco is connected to these earlier attacks.
The media has contacted the third-party provider suspected of involvement in the June breaches but has not yet received a response. Cisco has not provided further details about the potential breach’s nature or the compromised data’s extent.
