Hewlett Packard Enterprise (HPE) Investigates Breach as Hacker Claims to Steal Source Code

Hewlett Packard Enterprise (HPE) is actively investigating claims of a new breach after a threat actor claimed responsibility for stealing sensitive documents from the company's developer environments. This development has raised concerns about the security of the company's internal systems, potentially jeopardizing not only its intellectual property but also customer data. Although HPE has so far denied any operational impact, the threat actor’s claims and the potential consequences are raising alarms in the cybersecurity community.

The Alleged Breach

On January 16, 2025, HPE became aware of a new security claim made by a hacker group known as IntelBroker. The group allegedly gained unauthorized access to HPE’s systems and stole several documents and files from the company’s developer environments. The threat actor also claimed to have obtained highly sensitive materials, including private and public certificates, Zerto and iLO source code, Docker builds, and user information linked to deliveries.

The hacker group, IntelBroker, reportedly accessed critical company assets, including:

• API credentials
• WePay credentials
• GitHub repositories (both private and public)
• Source code for various internal tools
• Certificates (private and public keys)
• Docker builds
• Old user personal information used for deliveries

Despite these serious allegations, HPE responded to the claims by saying that it had found no evidence of a security breach affecting its operations or customer data. A spokesperson for HPE, Clare Loxley, told BleepingComputer that the company immediately activated its cyber response protocols upon learning of the allegations. The company disabled the credentials related to the reported breach and began an internal investigation to verify the hacker group’s claims.

HPE also emphasized that, at the time of the announcement, there was no operational impact on its business, nor was there any indication that customer information was involved in the incident. The company’s proactive steps illustrate its commitment to securing its network, but the breach claims highlight the growing threats facing major corporations in today’s increasingly hostile cyber landscape.

IntelBroker’s Previous Breaches and Reputation

IntelBroker is no stranger to high-profile breaches and cyberattacks. The hacker group gained notoriety in 2024 for breaching the systems of DC Health Link, the organization responsible for administering health care plans for members of the U.S. House of Representatives. This breach led to a significant data leak that exposed the personal information of 170,000 individuals. The leak prompted a congressional hearing to investigate the breach and understand how such sensitive data was compromised.

IntelBroker’s activities are not limited to this one incident. The group has been linked to multiple other cyberattacks, including breaches of major organizations like:

• Nokia
• Cisco
• Europol
• Home Depot
• Acuity

The hacker group has also allegedly been involved in hacking attempts on companies like AMD, the State Department, Zscaler, Ford, and General Electric Aviation. Their reach is broad, and their methods of intrusion have been sophisticated, making them a formidable threat actor in the cybersecurity world.

Previous Breaches at HPE

This is not the first time HPE has been targeted by cybercriminals. The company has been the victim of several high-profile breaches in the past. For instance, in 2018, the advanced persistent threat (APT) group APT10, reportedly linked to the Chinese government, compromised HPE’s systems. The attackers allegedly used their access to hack into customer devices, further emphasizing the vulnerabilities in HPE’s internal network at the time.

More recently, in 2021, HPE disclosed that its Aruba Central network monitoring platform had been breached. In this incident, attackers gained access to sensitive data about monitored devices, including information about their locations. While this breach did not involve customer data directly, it highlighted the challenges faced by companies in maintaining the security of their internal systems, especially when dealing with complex infrastructure.

HPE also disclosed another breach in 2023, this time involving its Microsoft Office 365 email environment. The company revealed that attackers, believed to be part of the Russian hacking group APT29 (linked to Russia’s Foreign Intelligence Service, SVR), had accessed the email environment in May 2023. This breach raised concerns about the security of HPE’s email communications and the potential impact on sensitive corporate data.

Security Measures and the Ongoing Investigation

In response to the latest breach claims, HPE has activated its standard cyber response protocols. These measures are designed to identify and mitigate the impact of potential breaches and ensure the company’s systems remain secure. HPE also worked quickly to disable any credentials that the hackers may have obtained and launched an internal investigation to determine the validity of IntelBroker’s claims.

While HPE has not found any evidence to support the breach allegations so far, the company’s investigation is ongoing. It’s important to note that cybersecurity incidents are often complex and may not reveal their full extent immediately. As a result, HPE will likely continue to monitor its systems and work with external cybersecurity experts to determine whether any of its assets were compromised.

For organizations like HPE, ensuring the security of their systems is a top priority. This includes employing a wide range of security measures, such as:

• Strong authentication mechanisms
• Encryption of sensitive data
• Regular audits and penetration testing
• Incident response plans and rapid reaction capabilities

However, as the sophistication of cyberattacks continues to evolve, even the most secure organizations are vulnerable to breaches. Companies must remain vigilant and continue to invest in cybersecurity technologies and practices to protect their assets, data, and customers.

Broader Implications for the Cybersecurity Landscape

The ongoing investigation into the alleged breach at HPE highlights several broader trends in the cybersecurity landscape. First, it underscores the growing sophistication and persistence of cybercriminals, especially those operating in hacker groups like IntelBroker. These groups often target high-value organizations to gain access to sensitive data, intellectual property, and other valuable resources.

Second, the rise of cybercrime syndicates has made it increasingly difficult for organizations to maintain complete control over their digital environments. Even with robust security measures in place, businesses face a constant threat of being targeted by malicious actors. The use of advanced tactics such as social engineering, phishing, and exploitation of vulnerabilities further complicates the task of defending against cyberattacks.

Finally, the breach claims highlight the need for businesses to not only implement strong security practices but also to be transparent with customers and the public when security incidents occur. While HPE has denied any operational impact, its prompt response and investigation demonstrate the company’s commitment to maintaining the trust of its customers and stakeholders. Transparency during security incidents is essential for preserving confidence in a company’s ability to safeguard its data and systems.

Conclusion

The investigation into the claims of a security breach at Hewlett Packard Enterprise serves as a stark reminder of the ongoing cybersecurity threats faced by major corporations worldwide. Despite the company’s reassurances that no customer data has been impacted and that operations remain unaffected, the breach allegations raised by IntelBroker have exposed vulnerabilities in HPE’s systems. These claims are part of a broader trend of increasingly sophisticated cyberattacks targeting valuable assets within the corporate world.

As HPE continues its investigation, the outcome of this case will likely provide valuable insights into the tactics and methods employed by cybercriminals, as well as the effectiveness of HPE’s cybersecurity protocols. In the meantime, businesses and individuals alike must remain vigilant against potential threats and prioritize the security of their systems and data.