Cisco takes its developer hub offline following data theft
It still stays by its assessment that there was no breach
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cisco has taken its DevHub website offline following a cyberattack and a data leak incident. It also played down the value of the breach and said it shut down the site “out of an abundance of caution”.
Recently, a known data leaker, alias IntelBroker, posted a new thread on the infamous BreachForums, offering Cisco data for sale.
In the thread, the hacker credited EnergyWeaponUser and zjj for the breach, and stated that the archive includes Github projects, Gitlab projects, SonarQube projects, source code, hardcoded credentials, certificates, customer SRCs, confidential documents, Jira tickets, API tokens, AWS private buckets, Cisco Technology SRCs, Docker builds, Azure Storage buckets, private & public keys, SSL certificates, and more.
Exposed API token
Cisco responded by saying it was investigating the breach, and has now come forward with additional information.
“Based on our investigations, we are confident that there has been no breach of our systems,” Cisco said. “We have determined that the data in question is on a public-facing DevHub environment—a Cisco resource center that enables us to support our community by making available software code, scripts, etc. for customers to use as needed. We have determined that a small number of files that were not authorized for public download may have been published.”
The announcement also states there is no evidence of personally identifiable information (PII) orfinancialdata being exposed this way, but Cisco is continuing its investigation.
“Out of an abundance of caution, we have disabled public access to the site while we continue the investigation.”
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
But IntelBroker disagrees that there was no breach. Speaking to BleepingComputer, they said they gained access to a Cisco third-party developer environment through an exposed API token. They also told the publication that they had access to Cisco’s developer environment, and even shared screenshots as proof.
“While Cisco continues to say that no systems were breached, everything we have seen does indicate that a third-party development was breached, allowing the threat actor to steal data,” the publication concluded.
ViaBleepingComputer
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Scammers are using fake copyright infringement claims to hack businesses
HPE reveals critical security bug affecting networking access points
From Dishonored to Mafia: Definitive Edition, some of my favorite games are free right now for Amazon Prime members
