Lyce · Hybrid Watch
hw_d1ecec787bf0e91b
APT29 hack Hewlett Packard Enterprise email system and sharepoint server, steal files.
On January 24, Hewlett Packard Enterprise (HPE) revealed that suspected Russian-linked hackers from the APT29 group had compromised its Microsoft Office 365 email environment, gaining access to information belonging to the company’s cybersecurity team and other departments. HPE discovered the breach on December 12, 2023, and determined that the attackers had gained access to its cloud-based email system as early as May 2023. The hackers also compromised HPE’s SharePoint server, where they accessed and exfiltrated files.
Attribution
Official
Facts
No facts
Sources
-
- Role
- Discovery lead
- Publication
On January 24, Hewlett Packard Enterprise (HPE) revealed that suspected Russian-linked hackers from the APT29 group had compromised its Microsoft Office 365 email environment, gaining access to information belonging to the company’s cybersecurity team and other departments. HPE discovered the breach on December 12, 2023, and determined that the attackers had gained access to its cloud-based email system as early as May 2023. The hackers also compromised HPE’s SharePoint server, where they accessed and exfiltrated files.
-
- Role
- Discovery lead
- Publication
Hewlett Packard Enterprise told regulators that suspected Russian state-backed hackers from the SVR-linked group Cozy Bear (Midnight Blizzard) broke into its cloud-based email system and spent months quietly exfiltrating data. HPE said it was informed on 12 December 2023 that the actor had accessed its Microsoft 365 environment and later determined that email belonging to a limited number of employees—primarily in cybersecurity and go-to-market or business segments—had been compromised since around May 2023, alongside earlier theft of a small set of SharePoint files. The company emphasised that only a small percentage of mailboxes were affected and that it does not currently consider the incident “material” to its operations or finances, but the focus on security and strategic staff indicates an intelligence-gathering objective rather than disruption or ransomware-style extortion. Reporting noted that the same Russian group was simultaneously running a parallel campaign against Microsoft itself, targeting senior leadership and security/legal teams, which places the HPE breach within a broader pattern of long-term espionage operations against key U.S. technology providers whose platforms support government and critical-infrastructure customers.