Cisco Investigates Major Data Breach Stolen Data up for Sale Online

Cisco is found to be currently investigating a possible data breach following reports that allegedly stolen data has surfaced for sale on a hacking forum.

The stolen data claims have been linked to a threat actor known as "IntelBroker" who, along with two others— "EnergyWeaponUser" and "zjj"—claims to have breached Cisco on June 10, 2024.

According to IntelBroker, the breach compromised a whole host of sensitive information, including:

GitHub and GitLab project repositories
Source code
Hard-coded credentials
SSL Certificates
Docker builds
API tokens
AWS and Azure storage bucket data
Confidential Cisco documents, and more.

Cisco’s Response

A Cisco spokesperson confirmed the company is aware of the alleged breach and that an investigation is ongoing to assess the extent of the situation. At this time, Cisco has not confirmed the authenticity of the claims or the data samples that have been leaked.

Cisco's statement: > _"We have launched an investigation to assess this claim, and our investigation is ongoing."_

Alleged Attacker’s Claims

IntelBroker which has been involved in many targeted cyberattacks namely Facebook & General Electronics along with their associates have provided samples of the alleged stolen data on a hacking forum. These samples include:

A customer database
Customer information
Documentation related to customers
Screenshots from internal customer management portals.

While details of how the data breach has transpired remain still unclear, the type of data presented suggests access to core developer infrastructure and proprietary code repositories, potentially via compromised DevOps systems.

Critical Data at Risk

The threat actor’s post indicated that many of Cisco’s most crucial assets were allegedly infiltrated.

Some of the more alarming categories include:

Source Code Repositories: IntelBroker claims access to multiple source code repositories hosted on GitHub, GitLab, and SonarQube. This can pose a serious risk to Cisco’s intellectual property, potentially allowing attackers to identify vulnerabilities in Cisco products.

Hard-Coded Credentials and API Tokens: The presence of hard-coded credentials within the code repositories could allow further exploitation of other systems if not remediated promptly.

Confidential Cisco Documents: Exposure of internal documentation could reveal sensitive corporate strategies, undisclosed technologies, and private communications.

Cloud Infrastructure Access: AWS private buckets, Azure storage, and Docker build data are all listed as compromised. Breaching cloud infrastructure is a serious issue as it can lead to further compromise of confidential services or data leakage.

Private & Public Keys, SSL Certificates: If SSL certificates or cryptographic keys have been compromised, the breach could extend to disrupting secure communication channels.

Analysis of Previous Incidents

This is not the first time IntelBroker has been associated with major data breaches. Since June 2024, the group has been involved in leaking or selling data from various high-profile companies such as T-Mobile, AMD, and Apple. These previous attacks reportedly exploited vulnerabilities in third-party DevOps and software development services providers.

It remains unclear whether the Cisco breach is related to those earlier incidents, but the scope of the alleged data exfiltration suggests that a third-party service provider might have been targeted once again.

However, this isn't an isolated intrusion where Cisco has been involved, previously the company suffered many intrusions such as detection of backdoor vulnerability in there smart licensing utility, there VPN have been exploited by ransomware group, their CISCO SPA 112 Phone Adapters were vulnerable to arbitrary code execution, Cisco AnyConnect had been exploited in the wild and many more.

Third-party vendors in DevOps often possess extensive access to company infrastructure, making them a high-value target for cybercriminals.

Implications of the Cisco Data Breach

If IntelBroker’s claims prove to be accurate, this breach could have severe implications for Cisco’s customers and partners. Compromised source code, credentials, and API tokens could potentially lead to:

Intellectual Property Theft: With source code and product designs in hand, competitors or criminal groups could clone or exploit Cisco products.

Secondary Attacks: The use of compromised credentials, API tokens, or customer documentation could lead to follow-up attacks, including ransomware, phishing, or fraud targeting Cisco’s customers.

Loss of Trust: A breach of this magnitude could significantly damage Cisco's reputation, especially among enterprise clients who rely on its technologies for secure networking solutions.

Regulatory and Legal Consequences: Cisco could face significant regulatory scrutiny, especially if customer or proprietary data is found to have been insufficiently protected.

Potential Remediation Strategies

While Cisco continues its investigation, there are several immediate steps the company should consider:

Revocation of Exposed Certificates and Credentials: Any SSL certificates, private keys, or hard-coded credentials that were potentially compromised must be revoked and replaced immediately.

Patch and Secure DevOps Systems: Since DevOps infrastructure appears to be the common thread in IntelBroker’s past breaches, Cisco should audit and strengthen security controls around its own DevOps tools and those of any third-party vendors.

Customer Communication and Incident Response: If customer information is indeed part of the compromised data, Cisco will need to proactively inform affected customers and assist them in securing their systems.

Security Audit of Code Repositories: A thorough audit of all GitHub, GitLab, and SonarQube repositories should be conducted to identify any potential vulnerabilities or further exposures of sensitive information.

As more companies integrate third-party services into their core development workflows, they become increasingly vulnerable to attacks targeting those services.

In the short term, it is critical for Cisco to validate IntelBroker’s claims, secure any exposed infrastructure, and collaborate with affected customers to mitigate potential risks. The long-term challenge will be fortifying the security of its development pipelines to prevent similar breaches in the future.

Cisco Investigates Major Data Breach Stolen Data up for Sale Online

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence