Antonio Neri, president and chief executive officer of Hewitt Packerd Enterprise (HPE), speaks during the HPE Discovery CIO Summit in Las Vegas, Nevada, U.S., on Tuesday, June 19, 2018. The summit brings together experts and industry leaders to explore the critical elements CIO’s must address to enable speed and agility, including people, use of data and approaches to security, governance and control. Photographer: Bridget Bennett/Bloomberg via Getty Images
Bloomberg | Bloomberg | Getty Images
Hewlett Packard Enterprise said Wednesday that its cloud-based email system was compromised by the Russian state-sponsored hacking group known as Midnight Blizzard or Cozy Bear.
The enterprise tech giant revealed the hack in a regulatory filing, saying that it was notified in December 2023 that “the threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions.”
HPE said that it is still investigating the hack, which it believes was related to another incident that occurred in June 2023. During that event, the hackers managed to compromise “a limited number of SharePoint files as early as May 2023,” HPE wrote in the filing.
“Following the notice in June, we immediately investigated with the assistance of external cybersecurity experts and took containment and remediation measures intended to eradicate the activity,” the company wrote. “Upon undertaking such actions, we determined that such activity did not materially impact the Company.”
HPE said it is working with law enforcement and will provide regulatory notifications if required as the investigation proceeds. So far, HPE said the hack “has not had a material impact” and that it “has not determined the incident is reasonably likely to materially impact” its financial health or operations.
Earlier in January, Microsoft said that the hacking group—which is also referred to as Nobelium or APT29—compromised some of the email accounts of its high-ranking executives. In 2020, this same Russian intelligence-linked hacking group also conducted the infamous breach of government supplier SolarWinds.
Both the U.S. Cybersecurity and Infrastructure Security Agency and Microsoft have previously linked the state-sponsored hacking group with the Russian foreign intelligence service SVR.
Microsoft and HPE’s disclosure of their respective breaches by the Russian-linked hacking group follows newly-enacted Securities and Exchange Commission rules requiring companies to disclose material cybersecurity incidents.
HPE shares were flat in after-hours trading on Wednesday at $15.76.
Watch: Microsoft hack could’ve been the start of a “pretty significant campaign.”
