On 14 October 2024, the hacker known as IntelBroker offered what they called a Cisco breach for sale on BreachForums, listing source code, hard-coded credentials, API tokens, certificates, private and public keys, AWS and Azure storage buckets, Docker builds and GitHub and GitLab projects. Cisco began investigating on 15 October and on 18 October confirmed that an attacker had obtained data from a public-facing DevHub environment, a resource centre where it shared software code and scripts with customers. Cisco said its own systems were not breached, that "a small number of files that were not authorized for public download may have been published," and that it had disabled public access to DevHub. IntelBroker claimed that after Cisco first tried to cut them off, they got back in using hard-coded credentials for an SSH server found in the stolen data. In December, IntelBroker leaked 2.9GB of the files, and Cisco said the root cause was a misconfigured data migration script and that some files related to a limited number of its CX Professional Services customers.
Key takeaways
- IntelBroker claimed on 14 October 2024 to have Cisco data including hard-coded credentials, API tokens, keys and certificates.
- Cisco confirmed the data came from its public-facing DevHub environment, not its internal systems, and disabled public access.
- IntelBroker claimed to have regained access using hard-coded SSH credentials found in the stolen files.
- Cisco later attributed the exposure to a misconfigured data migration script and notified affected CX customers.
- The identity lesson: files shared publicly must be checked for embedded credentials, because one stolen file can hand over the next set of keys.
At a glance
| Organisation | Cisco (DevHub resource centre) and a limited number of CX Professional Services customers |
|---|---|
| When | Claimed 14 October 2024; confirmed 18 October 2024; files leaked 16 December 2024 |
| Attacker | IntelBroker, with collaborators named in the sale listing |
| Entry point | Non-public files in a public-facing DevHub environment, exposed by a misconfigured data migration script, according to Cisco |
| Identities abused | Hard-coded credentials, API tokens and keys in the exposed files, according to the attacker; SSH credentials claimed to have been reused |
| Impact | Code, scripts and documentation taken; 2.9GB leaked; DevHub taken offline; affected customers notified |
| Category | NHI. Incident class: confirmed NHI breach (exposed files with embedded credentials; credential reuse claimed by the attacker) |
What happened
ITPro reported that on 14 October IntelBroker "posted on BreachForums that they compromised data including source code, hard-coded credentials, certificates, API tokens, private and public keys, AWS private buckets, Docker builds, and Azure storage buckets as well as GitHub and GitLab projects." IntelBroker also named customers, including Verizon, AT&T and Bank of America, as having production source code in the data. Cisco began investigating on 15 October.
On 18 October Cisco updated its advisory. TechTarget reported that Cisco was "confident" its systems had not been breached, but that the attacker obtained data from a public-facing DevHub environment, and quoted Cisco: "At this stage in our investigation, we have determined that a small number of files that were not authorized for public download may have been published." Cisco said the published information did not include sensitive personal or financial data, and disabled public access to DevHub "out of an abundance of caution."
The attacker gave a different picture of access. ITPro reported that IntelBroker claimed on 16 October to still have access, and that Cisco "had previously attempted to disable its access but had used hard-coded credentials on an SSH server IntelBroker identified within the exfiltrated data." After Cisco took DevHub offline, IntelBroker posted that the company had "finally revoked all our access. Closed our Docker, Maven hub[s] and SSH access." Cyberint reported that IntelBroker leaked 2.9 gigabytes of files on 16 December, and that Cisco "identified a misconfigured data migration script as the root cause of the exposure," notified the CX Professional Services customers whose files were involved and tightened controls over automation and public-facing platforms.
Timeline
| Date | Event |
|---|---|
| 14 October 2024 | IntelBroker offers Cisco data for sale on BreachForums. |
| 15 October 2024 | Cisco begins investigating. |
| 16 October 2024 | IntelBroker claims continued access using hard-coded SSH credentials. |
| 18 October 2024 | Cisco confirms data was taken from its public-facing DevHub and disables public access. |
| 16 December 2024 | IntelBroker leaks 2.9GB of DevHub files. |
| 18 December 2024 | Cisco names a misconfigured data migration script as the root cause, according to Cyberint. |
How it happened: the identity attack path
- Files exposed. A misconfigured data migration script left non-public files in the public DevHub environment.
- Data taken. The attacker downloaded code, scripts and documentation.
- Credentials inside. The attacker said the files contained hard-coded credentials, API tokens and keys.
- Access regained. IntelBroker claimed to use hard-coded SSH credentials to get back in after Cisco's first response.
- Portal closed. Cisco disabled public access, fixed the script and notified affected customers.
Impact
- Data: code, scripts and documentation from DevHub; 2.9GB later leaked.
- Customers: files relating to a limited number of CX Professional Services customers, who were notified.
- Service: public access to DevHub disabled during the investigation.
What this means for NHI governance
The confirmed failure here was a misconfiguration that made private files public. What made it an identity problem was what was in the files. According to the attacker, they contained hard-coded credentials, tokens and keys, and one set of SSH credentials let them return after being cut off. Every file that leaves an organisation, even to a customer resource centre, is a place where a non-human credential can escape.
Automation that moves data needs its own controls, and content published externally should be scanned for secrets first. See our Secrets Management Guide and SSH Key Management Guide.
Recommendations
- Scan before publishing. Check code and scripts shared externally for embedded credentials. See our Secrets Management Guide.
- Remove hard-coded SSH credentials. Use short-lived certificates or a vault instead. See the SSH Key Management Guide.
- Rotate everything in stolen files. Revoke any credential in exposed data at once, not after the investigation. See the Leaked Credential Response Playbook.
- Control automation that moves data. Review migration scripts and test what they make public. See the CI/CD Pipeline Identity Security Guide.
- Monitor public portals. Alert on bulk downloads and access to files marked non-public. See the ITDR Guide.
Frequently asked questions
Was Cisco breached in October 2024?
Cisco confirmed that an attacker obtained data from its public-facing DevHub environment but said its internal systems were not breached.
What caused the Cisco DevHub exposure?
Cisco identified a misconfigured data migration script that made files not meant for public download available, according to Cyberint.
Were credentials involved?
IntelBroker claimed the data included hard-coded credentials, API tokens and keys, and that hard-coded SSH credentials were used to regain access. Cisco did not confirm those details publicly.
Related NHI Mgmt Group resources
Cisco Active Directory Credentials Leak 2025 · Salt Typhoon and Cisco Flaw · Schneider Electric Breach 2024 · Secrets Management Guide · SSH Key Management Guide
How NHI Mgmt Group can help
Credentials hide in scripts, configuration and shared files. We help teams find them before they leave, replace them with short-lived access and respond fast when files are stolen. See our NHI and AI agent security training.
References
- TechTarget: Cisco confirms attackers stole data from DevHub environment (21 October 2024)
- ITPro: Cisco confirms attackers stole data, shuts down access to compromised DevHub environment (22 October 2024)
- Cyberint: Cisco Data Leak: The Facts on the Ground (25 December 2024)