The IT Nerd

Spanish fashion retailer MANGO has notified its customers of a data breach in which one of its external marketing services vendors suffered unauthorized access to certain customer data.

Roger Grimes, CISO Advisor at cybersecurity company KnowBe4, provided the following comments:

“Even the limited leak of only some personally identifying information can be of use to scammers. The hackers could craft a phishing message related to MANGO, and because the potential victim does have some sort of existing relationship with MANGO, any well-crafted phishing message is more likely to be successful than if it were some broad, generic type of phishing campaign. Every bit of information you give a scammer about someone can be used to craft a more realistic phishing message.”

“As an impacted customer, I’m concerned with not only my stolen information being used against me in some way, but also, if I want to remain a MANGO customer, in being reassured it won’t happen again. Has MANGO been able to figure out how it happened at the marketing supplier? Was it social engineering (very likely), unpatched software or firmware, or some other type of hacking attack? Because if they don’t know how the compromise happened, they can’t as easily take steps to ensure it won’t happen again. As a customer, I want to be reassured that MANGO knows how the hack of my information happened and what steps they have taken to make sure it doesn’t happen again.”

Re

F5 has disclosed that it was the target of a state-sponsored cyberattack, likely linked to Chinese threat actors, with attackers exfiltrating files that included BIG-IP source code and vulnerability information.

It’s unclear how long the hackers maintained access, but the company confirmed that they stole source code, vulnerability data, and some configuration and implementation details for a limited number of customers.

“Through this access, certain files were exfiltrated, some of which contained certain portions of the Company’s BIG-IP source code and information about undisclosed vulnerabilities that it was working on in BIG-IP,” the company states.

Despite this critical exposure of undisclosed flaws, F5 says there’s no evidence that the attackers leveraged the information in actual attacks, such as exploiting the undisclosed flaw against systems. The company also states that it has not seen evidence that the private information has been disclosed.

F5 claims that the threat actors’ access to the BIG-IP environment did not compromise its software supply chain or result in any suspicious code modifications.

This includes its platforms that contain customer data, such as its CRM, financial, support case management, or iHealth systems. Furthermore, other products and platforms managed by the company are not compromised, including NGINX, F5 Distributed Cloud Services, or Silverline systems’ source code.

Will Baxter, Field CISO, Team Cymru had this comment:

“This is another reminder that the modern attack surface extends deep into the software development lifecycle. Threat groups targeting source code repositories and build environments are seeking long-term intelligence value—understanding how security controls operate from the inside. Visibility into outbound connections, threat actor command-and-control infrastructure, and unusual data exfiltration patterns is key to identifying this activity early. Combining external threat intelligence with internal telemetry gives defenders the context needed to detect and contain these advanced intrusions.”

If I were a F5 customer, I’d be kind of nervous right now. Because there’s no telling what this threat actor can do with the data that they stole. Other than the fact that whatever they do with that data, it won’t be good for anyone.

UPDATE: Cybercrime expert and VP of Cyber Risk for HITRUST, Tom Kellermann offers up this comment:

“This is the first stage of a supply chain campaign designed to compromise trust in digital infrastructure. Rogue nation-state actors consistently show us how successful and well-resourced they are. Once adversaries gain access at the application layer, they’re not just stealing data but embedding themselves for command and control. F5 customers must immediately enhance detection and response at the application layer through ADR. Supply chain attacks have become the preferred tactic of modern cyber warfare. We need to start treating third-party risk as a national security issue.”