Cisco investigates breach after stolen data for sale on hacking forum

[VincaSec]

Cisco has confirmed to BleepingComputer that it is investigating recent claims that it suffered a breach after a threat actor began selling allegedly stolen data on a hacking forum.

"Cisco is aware of reports that an actor is alleging to have gained access to certain Cisco-related files," a Cisco spokesperson told BleepingComputer.

"We have launched an investigation to assess this claim, and our investigation is ongoing."
This statement comes after a well-known threat actor named "IntelBroker" said that he and two others called "EnergyWeaponUser and "zjj" breached Cisco on October 6, 2024, and stole a large amount of developer data from the company.

"Compromised data: Github projects, Gitlab Projects, SonarQube projects, Source code, hard coded credentials, Certificates, Customer SRCs, Cisco Confidential Documents, Jira tickets, API tokens, AWS Private buckets, Cisco Technology SRCs, Docker Builds, Azure Storage buckets, Private & Public keys, SSL Certificates, Cisco Premium Products & More!," reads the post to a hacking forum.

https://www.bleepingcomputer.com/news/se...ing-forum/

   

---

Cisco takes DevHub portal offline after hacker publishes stolen data

Cisco confirmed today that it took its public DevHub portal offline after a threat actor leaked "non-public" data, but it continues to state that there is no evidence that its systems were breached.

"We have determined that the data in question is on a public-facing DevHub environment—a Cisco resource center that enables us to support our community by making available software code, scripts, etc. for customers to use as needed," reads an updated statement from Cisco.
"At this stage in our investigation, we have determined that a small number of files that were not authorized for public download may have been published."
Cisco says there are no indications that personal information or financial data was stolen but is continuing to investigate what data may have been accessed.
This statement comes after a threat actor known as IntelBroker claimed to have breached Cisco and attempted to sell data and source code stolen from the company.

https://www.bleepingcomputer.com/news/se...olen-data/