HCLTech hacking claims: IT major says no evidence of systems or client breach, further investigation underway
HCLTech has said it has found no evidence that its systems or client environments were breached after a hacker group allegedly claimed exposure of limited
HCLTech has said it has found no evidence that its systems or client environments were breached after a hacker group allegedly claimed exposure of limited employee-related data. The clarification comes a day after rival IT major Tata Consultancy Services (TCS) disclosed that it had received threat-intelligence alerts about possible exposure of employee information. In a filing dated 10 August, HCLTech said its initial investigation suggested that the data referred to in the claims could be limited in scope and several years old. The company added that there was no evidence of a breach of its systems or any engagement with its clients. The company said it is continuing its investigation and will disclose any material findings.
HCLTech also reiterated that cybersecurity remains a priority and that it is committed to protecting information entrusted to it. The development is significant for India's large IT services companies, which manage sensitive data and technology infrastructure for global enterprises. However, the statements from both HCLTech and TCS so far distinguish between claims of employee-data exposure and a confirmed compromise of their systems. What HCLTech said about the alleged data exposure HCLTech's filing followed media reports about claims made by a hacker group regarding the potential exposure of certain data relating to its employees. The company did not confirm that the alleged data originated from a recent breach. Instead, its preliminary assessment indicated that the information could be limited and dated back a few years.
HCLTech also specifically said there was no evidence of a breach involving its own systems or its engagement with clients. The company has not disclosed the nature or volume of the data allegedly exposed. It also has not said whether the information was obtained directly from HCLTech systems or through another source. HCLTech said its investigation is still underway and that any material findings will be reported to the stock exchanges. TCS also says customer systems remain unaffected The HCLTech clarification came shortly after TCS disclosed a similar cybersecurity-related alert. TCS said it had received threat-intelligence information alleging possible exposure of some employee information but said its investigation had found no credible evidence of a breach of TCS systems or customer environments.
TCS said the information referenced in the alert appeared to be more than four years old and was limited to basic employee information. It also said there was no indication that customer data, customer systems or its operational systems had been affected. According to TCS, the attacker claimed to have used techniques including password spraying and MFA fatigue. The company said safeguards against such techniques had been in place for more than two years and that it continued to monitor its environment.
The BriefWire