\n<\/p>\n
A former IBM cybersecurity executive accused the company of getting hacked three times in the previous decade by foreign governments and then covering up the breaches.\u00a0<\/p>\n
In a lawsuit unsealed this week<\/a> but filed in 2020, William Barlow, who was IBM\u2019s vice president of threat intelligence until August 2019, said IBM concluded Chinese hackers breached its core network between 2013 and 2016 but that the company then covered up the breaches and never disclosed them. Barlow also said at least two IBM subsidiaries were also breached, and that IBM covered up those breaches as well.<\/p>\n Barlow alleged in his complaint that IBM\u2019s core network was \u201croutinely hacked by foreign state actors and others,\u201d adding that data was frequently stolen and government agencies were \u201cnever notified.\u201d\u00a0<\/p>\n While the alleged breaches date back more than a decade, the news shows that cyberattacks, even those affecting large public tech companies such as IBM, sometimes never get disclosed, either to the public or to relevant government authorities. IBM is a major cybersecurity vendor to the U.S. federal government, which makes the alleged concealment especially significant. In the last few years, several data breach notification laws have been passed<\/a> to counter this problem.\u00a0\u00a0\u00a0<\/p>\n Bloomberg first reported on the lawsuit<\/a>.<\/p>\n IBM spokesperson Miki Carver declined to answer specific questions about the lawsuit and the underlying accusations. Instead, Carver told TechCrunch, \u201cThis complaint was filed six years ago, and the U.S. Department of Justice declined to intervene. IBM is confident that our actions followed the letter of the law.\u201d<\/p>\n In particular, Barlow said IBM was among several victims of a hacking campaign carried out by APT 10, a Chinese government-linked group that then-FBI Director Christopher Wray said had targeted a \u2018Who\u2019s Who<\/a>\u2018 of the global economy when its members were indicted in 2018. The hackers broke into both the company\u2019s network and the data it maintained there in partnership with AT&T.\u00a0<\/p>\n Barlow alleged that in March 2017, intelligence officials from the Australia, Canada, New Zealand, United States, and the United Kingdom \u2014 the so-called Five Eyes alliance \u2014 warned IBM of the breach, which prompted an internal investigation.<\/p>\n According to the complaint, the investigation concluded that APT 10 potentially breached IBM\u2019s network more than 56,000 times between 2013 and 2016. Crucially, the company said it could not investigate further because it had not kept logs of who accessed its network and when \u2014 a basic security practice.<\/p>\n IBM then allegedly failed to alert any authorities or the U.S. government, one of its main customers.\u00a0<\/p>\n \u201cAs IBM and AT&T\u2019s Core Networks\u2019 infrastructure is archaic, hackers have been able to gain access to the system on numerous occasions and can roam almost anywhere undetected,\u201d read the complaint, which explained that IBM\u2019s internal investigation concluded four servers were compromised in the APT 10 hacking campaign.<\/p>\n \u201cThe attackers have compromised and\/or accessed nearly 400 compromised accounts and almost 200 total systems and servers across every IBM business unit, eighteen countries, and multiple IBM products,\u201d said an internal IBM report about the investigation into the breach, according to the complaint. <\/p>\n Jason Brown, a lawyer representing Barlow, told TechCrunch that his firm is \u201clooking forward to aggressively litigating the matter.\u201d\u00a0<\/p>\n \u201cYou can\u2019t sell cybersecurity to the federal government while allegedly having these security problems within your own company,\u201d said Brown.\u00a0<\/p>\n According to Barlow, other breaches he was aware of affected Trusteer, a cybersecurity startup acquired by IBM in 2013, which he says was breached in 2018; and Truven, a healthcare data startup IBM acquired in 2016, which he says was breached multiple times after the acquisition.<\/p>\n In both cases, Barlow accused IBM of failing to properly investigate and disclose these breaches.\u00a0<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n