Acuity, a federal contractor that works with U.S. authorities businesses, has confirmed that hackers breached its GitHub repositories and stole paperwork containing previous and non-sensitive knowledge.
Acuity is a tech consulting agency with nearly 400 workers and a $100+ million annual income that gives DevSecOps, cyber safety, knowledge analytics, and operations help providers to federal civilian nationwide safety prospects.
The U.S. Division of State informed BleepingComputer it is investigating claims of a cyber incident after a risk actor often called IntelBroker leaked allegedly stolen U.S. authorities and navy knowledge on a hacking discussion board however refused to supply particulars on the character and scope of the breach “for security reasons.”
“Acuity recently identified a cybersecurity incident related to GitHub repositories that housed dated and non-sensitive information. Immediately upon becoming aware of this zero-day vulnerability, Acuity applied the vendor’s security updates and performed mitigating actions in accordance with the vendor’s guidance,” Acuity CEO Rui Garcia informed BleepingComputer on Thursday in an emailed assertion.
“After conducting our own analysis and following a third-party cybersecurity expert investigation, Acuity has seen no evidence of impact on any of our clients’ sensitive data. In addition to cooperating with law enforcement, Acuity takes the security of its customers’ data seriously and is implementing appropriate measures to secure its operations further.”
Whereas the corporate did not present additional information, possible due to the continued investigation, IntelBroker (one of many risk actors behind the assault) has leaked 1000’s of data containing info belonging to Justice Division, State Division, DHS, and FBI workers.
​He additionally claims they stole 5 Eyes intelligence alliance paperwork, some allegedly containing categorized info.
Sangierro, one other risk actor concerned within the assault, informed BleepingComputer the breach occurred on March 7, and so they purportedly exploited a vulnerability in an Acuity Tekton CI/CD server to steal GitHub credentials and entry their non-public repositories.
IntelBroker has been leaking knowledge allegedly stolen from or belonging to a number of U.S. authorities businesses since December, together with however not restricted to the Immigration and Customs Enforcement (ICE), the Citizenship and Immigration Companies (USCIS), the Division of Protection, and the U.S. Military.
He rose to fame after efficiently breaching DC Well being Hyperlink, which administers the healthcare plans of U.S. Home members, their employees, and their households.
The risk actor has additionally taken accountability for different cyberattacks, together with Hewlett Packard Enterprise (HPE) and an alleged breach of Normal Electrical Aviation.
