HPE Alerts Data Breach Victims Following Russian Government Cyberattack

In a concerning development for data security, Hewlett Packard Enterprise (HPE) has initiated notifications to individuals affected by a significant cyberattack that occurred in 2023. This breach, attributed to Russian government hackers, has raised alarms about the safety of personal information.

Details of the Cyberattack on HPE

According to a review by TechCrunch, HPE has notified over a dozen individuals regarding the theft of their personal information. The breach has been formally documented in notices submitted to at least two U.S. state attorneys general.

Types of Data Compromised

The compromised data includes:

• Social Security numbers
• Driver’s license information
• Credit card numbers

This alarming information was revealed in a filing with the Massachusetts state authorities.

Timeline of the Incident

The cyber intrusion reportedly began in May 2023, impacting HPE’s email systems and Microsoft SharePoint environments. HPE publicly acknowledged the breach in January 2024, stating that the hackers managed to exfiltrate data from a “small number” of email mailboxes and some SharePoint files.

Method of Attack

According to HPE, the hackers gained access through “a compromised account,” allowing them to infiltrate internal email boxes within the Office 365 environment. The majority of the stolen data belonged to employees within HPE’s cybersecurity, go-to-market, and business teams.

Attribution of the Attack

HPE has linked the cyberattack to a group known as Midnight Blizzard, which security experts believe is associated with Russia’s foreign intelligence service, the SVR. This group, also recognized as APT29, has been implicated in numerous high-profile cyber incidents, including the notorious 2019 SolarWinds espionage attack targeting the U.S. government.

Microsoft’s Involvement

In a related disclosure, Microsoft confirmed in January 2024 that its corporate network was also compromised by Midnight Blizzard. The tech giant reported that Russian hackers specifically targeted the email accounts of corporate executives and senior cybersecurity personnel, likely to gain insight into the company’s understanding of the threat actors.

For more information on cybersecurity best practices, you can visit CISA.

As the investigation continues, affected individuals are urged to monitor their accounts and report any suspicious activity. Staying informed about such breaches is crucial in today’s digital landscape.