Cisco confirms hacking of source code, scripts, and digital certificates

Cisco has officially confirmed the authenticity of more than 4 GB of sensitive data leaked by a hacker going by the alias IntelBroker. The tech giant’s internal systems, however, remain uncompromised. The leaked data was initially disclosed on October 14, 2024, and was said to be obtained from a public-facing Cisco DevHub environment, not its secure enterprise systems. The DevHub served as a repository for source code, scripts, and other resources provided to customers.

Cisco has acknowledged that over 4 GB of data leaked by a hacker named IntelBroker is authentic but it has stressed that no breach of its core systems occurred. The data was taken from a public-facing resource center, confirming its connection to a previously disclosed incident. While much of the data hosted in this environment was already publicly accessible, some files, including encryption keys, certificates, and credentials, were inadvertently exposed and subsequently leaked.

IntelBroker initially claimed to have exfiltrated 800 GB of files but later revised the figure to 4.5 TB. The first batch of approximately 3 GB was made available in mid-December. This was followed by a second release on Christmas Day, bringing the total to over 4 GB.

Cisco’s internal investigation clarified that no unauthorized access to its production or enterprise systems occurred. The company stated, “There has been no breach of our systems, and we have not identified any content that could have been used to compromise our operations.” This statement aligns with earlier updates, confirming that the incident was limited to the DevHub instance.