Dive Brief:

• Hewlett Packard Enterprise began issuing data breach notifications to various state attorney general offices regarding personal data, including Social Security and credit card numbers, that were exposed in a 2023 cyberattack.

• In the attack, a Russian state-backed threat group known as Midnight Blizzard gained access to HPE's Office 365 email environment for months and exfiltrated data from a "small percentage" of mailboxes.

• Midnight Blizzard, also known as APT29 and Cozy Bear, is also responsible for the massive supply chain attack on SolarWinds as well as a similar breach of Microsoft's corporate email system that was discovered in early 2024.

Dive Insight:

HPE's Midnight Blizzard attack was first disclosed in January 2024 in an 8K filing with the Securities and Exchange Commission. According to the filing, HPE was notified on Dec. 12, 2023, that a suspected nation-state threat group had breached its Office 365 email environment. An investigation revealed that starting in May 2023, Midnight Blizzard actors accessed emails and pilfered data from mailboxes "belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions."

In a breach notification letter filed with the New Hampshire attorney general's office, the tech giant disclosed that some individuals' personal data may have been exposed in the breach. HPE emphasized that the incident has since been contained and remediated.

"HPE's forensic investigation determined that certain individuals’ personal information may have been subject to unauthorized access," the letter stated. "With the assistance of e-discovery specialists, HPE conducted a thorough review of the data at issue to identify the types of information that may have been subject to unauthorized access and determine to whom this information relates."

While the letter did not specify what types of personal data were exposed, a separate breach notification filing with the state of Massachusetts indicated that Social Security numbers, driver's license numbers and credit/debit card numbers were compromised in the attack. An HP spokesperson told Cybersecurity Dive that some of the exposed data belongs to customers.

"The information accessed was limited to what was contained in a small percentage of HPE employee email boxes," the spokesperson said. "We notified those users, as well as a small number of customers whose information may have been in those emails. We are not providing exact counts."

HPE's breach came to light shortly after Microsoft revealed a similar incident in January 2024 in which Midnight Blizzard gained access to "a very small percentage of Microsoft corporate email accounts." Following an investigation, Microsoft later disclosed that Midnight Blizzard used password spraying attacks to compromise a legacy non-production test tenant account that did not have MFA enabled.