Pierluigi Paganini December 30, 2024

Cisco confirmed the authenticity of the 4GB of leaked data, the data was compromised in a recent security breach, marking the second leak in the incident.

Cisco confirmed the authenticity of the 4GB of leaked data, which was compromised in a recent security breach, marking it as the second leak in the incident.

“We are aware of some recent social media posts made by the actor. Based on information available to us at this time, we believe that the files referenced in the posts are files that we had previously identified during our investigation and reported on. On Wednesday, December 25, 2024, at 17:07 EST, the threat actor IntelBroker posted on X about releasing more data. At 17:40 EST, IntelBroker released 4.45 GB of data for free on BreachForums. We have analyzed the post data, and it aligns with the known data set from October 14, 2024.” reads the update published by Cisco.

In October 2024, Cisco confirmed that the data posted by the notorious threat actor IntelBroker on a cybercrime forum was stolen from its DevHub environment.

IntelBroker claimed to have gained access to Github projects, Gitlab Projects, SonarQube projects, Source code, hard coded credentials, Certificates, Customer SRCs, Confidential Documents, Jira tickets, API tokens, AWS Private buckets, company Technology SRCs, Docker Builds, Azure Storage buckets, Private & Public keys, SSL Certificates, Cisco Premium Products, and other info.

According to Cisco, the attackers obtained the data from a public-facing DevHub environment.

DevHub is a platform designed for developers to access resources, tools, and APIs to build and integrate applications with Cisco’s technologies. It provides a range of development resources, including SDKs (Software Development Kits), documentation, sample code, and learning materials for networking, security, and cloud infrastructure.

Below is an update published on October 18, 2024:

• Based on our investigations, we are confident that there has been no breach of our systems.
• We have determined that the data in question is on a public-facing DevHub environment—a Cisco resource center that enables us to support our community by making available software code, scripts, etc. for customers to use as needed.
• At this stage in our investigation, we have determined that a small number of files that were not authorized for public download may have been published.
• As of now, we have not observed any confidential information such as sensitive PII or financial data to be included but continue to investigate to confirm.
• Out of an abundance of caution, we have disabled public access to the site while we continue the investigation.
• Meanwhile, Cisco will engage directly with customers if we determine they have been impacted by this event.

The company disabled public access to the site while we continue the investigation.

Cisco analyzed the second leak and determined that it is linked to the previously identified data set from October 14, 2024.

The IT giant pointed out that its infrastructure was not breached by threat actors.

“As noted in prior updates, we are confident that there has been no breach of our systems, and we have not identified any information in the content that an actor could have used to access any of our production or enterprise environments.” concludes the update.

IntelBroker targeted many major organizations in past attacks, including AMD, AT&T, Bank of America, Microsoft, Europol, SAP, T-Mobile, Verizon, and others.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)