A whistleblower lawsuit alleges that IBM and AT&T concealed significant data breaches from the US government, involving foreign hackers including APT10, a Chinese government-linked group. William Barlow, a former IBM executive, filed the suit in 2020, alleging that both companies failed to disclose these incidents to regulatory bodies and their government clients. The allegations have sparked renewed scrutiny over cybersecurity practices within major corporations and their obligations to transparency.
According to the lawsuit, IBM’s core network experienced a series of breaches between 2013 and 2016. An internal investigation reportedly revealed more than 56,000 potential intrusions attributed to APT10 during this period. These breaches spanned 18 countries and impacted multiple IBM business units, granting access to nearly 400 compromised accounts and almost 200 systems.
The lawsuit claims that despite warnings from the Five Eyes alliance in 2017 regarding security concerns, IBM did not disclose these breaches. This alleged failure to inform US regulators or government clients has raised questions about compliance with reporting requirements and potential national security implications. The complaint is currently pending before a federal court in New York.
The accusations extend beyond IBM, implicating AT&T as well. International Business Machines Corp. and AT&T Inc.’s computer systems were repeatedly breached by foreign hackers according to the lawsuit. While details of AT&T’s involvement remain less clear within the publicly available information, the inclusion highlights a broader potential failure in securing sensitive data across interconnected organizations.
The case has drawn significant attention due to its implications for corporate accountability and cybersecurity transparency. The allegations suggest that IBM experienced over 56,000 intrusions by APT10 between 2013 and 2016, with infiltrated data maintained in partnership with AT&T. William Barlow left his position at IBM prior to filing the lawsuit. The incident underscores the importance of robust security protocols, diligent monitoring, and proactive disclosure practices within organizations handling sensitive data, especially those with government contracts or partnerships.
Sources:
- techcrunch.com
- cryptobriefing.com
- fortune.com
- thenextweb.com
- timesofindia.indiatimes.com
- bankinfosecurity.com
- theconversation.com
- cnbc.com
- irishtimes.com