IntelBroker claims responsibility for breach of Hewlett Packard Enterprise, selling sensitive data online

IntelBroker claims responsibility for breach of Hewlett Packard Enterprise, selling sensitive data online

Hewlett Packard Enterprise (HPE), a global provider of enterprise technology solutions based in Houston, Texas, is facing scrutiny following claims by the notorious hacker IntelBroker that they have successfully breached the company’s infrastructure. The breach allegedly exposed sensitive data, including proprietary source code, cryptographic certificates, and personal identifiable information (PII), now purportedly for sale on cybercrime forums.

 

IntelBroker, previously linked to high-profile cyber incidents, disclosed the breach to the cyber intelligence platform Hackread.com and publicized it on Breach Forums, a prominent marketplace for cybercriminal activities. The hacker alleges that the breach resulted from a direct attack on HPE’s infrastructure, bypassing the need for third-party compromises.

 

IntelBroker shared screenshots and a data tree that purportedly reveal access to HPE’s internal systems to support their claims. Initial analyses of the leaked material suggest that the compromised assets include private GitHub repositories, Docker builds, and sensitive configuration files for enterprise solutions like Zerto and Integrated Lights-Out (iLO) technology. Files such as ilo_client.py and zerto_bootstrapper.py appear to expose proprietary implementations, while cryptographic materials such as private keys and certificates highlight potential vulnerabilities in HPE’s security posture.

 

One screenshot showcases details from HPE’s SignonService web service, exposing endpoint addresses, WSDL links, and implementation classes that could offer cybercriminals insight into HPE’s infrastructure. Another image reveals sensitive configuration details, including Salesforce integration credentials, SAP S/4 HANA quoting services, and internal URLs, which could pose significant risks if exploited.

 

The hacker reportedly demands payment in Monero (XMR), a cryptocurrency favored for anonymity, in exchange for the stolen data. They have also indicated that they possess old PII related to delivery services, product APIs, and deployment files, amplifying the potential ramifications of the breach.

 

While HPE has yet to confirm or deny the claims’ validity publicly, the implications of such a breach are significant. The compromised assets suggest exposure of critical enterprise solutions and cryptographic resources, which could impact customers relying on HPE’s technology downstream.