Dive Brief:
- Hewlett Packard Enterprise was hit by a monthslong cyberattack that compromised the enterprise vendor’s cloud-based email environment, the company said Wednesday in a filing with the Securities and Exchange Commission.
- Corporate data from a “small percentage” of HPE mailboxes and a “limited number” of SharePoint files belonging to employees in cybersecurity and other business units was accessed and stolen starting in May, the company said.
- HPE said it was notified on Dec. 12 that a suspected state-sponsored threat actor, Midnight Blizzard, gained access to its email system. The Russia-affiliated group, also known as Cozy Bear, recently stole emails and other data from senior-level Microsoft executives. A company spokesperson declined to say who notified HPE of the suspected nation-state attack.
Dive Insight:
The attacks against HPE and Microsoft, both of which were disclosed in the past week, underscore Midnight Blizzard’s ability to gain footholds, maintain persistent access and remain undetected for months in at least two highly resourced enterprise firms.
The threat actor, formerly known as Nobelium, was behind the 2020 Sunburst attacks against SolarWinds and other companies.
“HPE eradicated the activity in our email environment shortly after being notified on Dec. 12, and we have observed no additional activity by the actor,” the company spokesperson said.
HPE said it was previously notified in June of unauthorized access to and exfiltration of company SharePoint files, which it immediately investigated and contained. Yet, the company determined the recently discovered theft of emails and other data was related to the same intrusion and threat actor, according to the SEC filing.
“The total scope of mailboxes and emails accessed remains under investigation,” HPE said in the filing.
The company said it disclosed the attack once its investigation concluded doing so would be in compliance with the new SEC cyber incident reporting rules.
“As of the date of this filing, the incident has not had a material impact on the company’s operations, and the company has not determined the incident is reasonably likely to materially impact the company’s financial condition or results of operations,” HPE said.
