Trellix Confirms Source Code Repository Breach

Cybersecurity giant Trellix has officially confirmed a security breach involving unauthorized access to a segment of its internal source code repository. The company, which emerged from the high-profile merger of McAfee Enterprise and FireEye, detected the intrusion through its internal monitoring systems. Upon discovery, Trellix immediately activated its incident response protocols, engaging third-party forensic experts and notifying federal law enforcement to begin a comprehensive investigation.

In a public statement addressing the incident, Trellix emphasized that the integrity of its products remains a top priority. While the firm acknowledged that portions of its code were accessed, they stated there is currently no evidence indicating that the source code has been weaponized or that distribution channels were compromised. Customers are advised that product updates and existing security protocols remain safe and operational as the internal audit continues.

The situation escalated on May 7, 2026, when the RansomHouse ransomware group took credit for the intrusion. The threat actors listed Trellix on their dark web data leak site, suggesting they had exfiltrated sensitive proprietary information during the breach. This group is known for utilizing "extortion-only" tactics, often forgoing traditional file encryption in favor of threatening to leak sensitive corporate data to the highest bidder.

Trellix is currently scrutinizing the claims made by RansomHouse to verify the authenticity and volume of the data allegedly stolen. The company’s security teams are working around the clock to determine the precise entry point of the attackers and to ensure that all vulnerabilities have been remediated. This investigation aims to map out the full scope of the exposure, from intellectual property to potential administrative credentials.

As the cybersecurity community watches closely, Trellix has committed to a policy of transparency. The company has promised to provide detailed technical updates once the forensic investigation concludes. For now, the focus remains on fortifying their infrastructure against future threats and ensuring that their global client base—ranging from government agencies to major enterprises—remains protected against any downstream risks.