HPE confirms data breach probe after IntelBroker claims

Hewlett Packard Enterprise (HPE) has confirmed it is investigating data breach claims made by the IntelBroker threat group.

Last week, IntelBroker published a statement on a data breach forum saying it had successfully breached HPE's network and nabbed information, offering it for sale on the dark web.

According to reports, the hackers claimed to have successfully snuck into parts of HPE's network for two days, accessing HPE's private GitHub repositories, APIs, and WePay service while managing to steal certificates, source code for Zerto and iLO, Docker builds, and personal data relating to deliveries.

HPE said the apparent hack was still being investigated, but stressed there was no customer data lost and the company was operating as normal.

"HPE became aware on January 16 of claims being made by a group called IntelBroker that it was in possession of information belonging to HPE," a company spokesperson said in a statement to ITPro.

"HPE immediately activated our cyber response protocols, disabled related credentials, and launched an investigation to evaluate the validity of the claims.

"There is no operational impact to our business at this time, nor evidence that customer information is involved."

HPE isn't the only big tech firm targeted by IntelBroker

Other attacks have been attributed to IntelBroker — believed to be led by a Serbian operating out of Russia — including breaches that leaked internal Apple tools and data from Europol, as well a health care provider used by American politicians.

Indeed, HPE was hit by similar data leak claims by IntelBroker this time last year; as with this latest incident, HPE said it hadn't found any evidence of a security breach.

That is a common pattern with IntelBroker claims. Companies find out via a statement on a hacking forum, investigate the incident, and then claim the intrusion wasn't serious and the data taken wasn't of any importance.

Companies targeted by IntelBroker have repeatedly disputed claims about the seriousness of the incident, saying any access was limited to small amounts of unimportant data, suggesting the hacks listed on dark-web forums were exaggerated.

Indeed, the hacker breached Cisco's systems in October, listing 2.9 terabytes of information on the dark web. But while Cisco admitted the incident, the company has stressed that the data wasn't confidential or sensitive in nature.

That was echoed in a subsequent breach at Nokia. IntelBroker released a cache of data stolen from the telco in November, but Nokia downplayed the incident, stressing that no company or customer data was actually leaked.

IntelBroker responded to such claims by releasing more data from the Cisco breach at the end of last year, and earlier this month said: "I promise you all some HQ leaks soon."