Citrix victim of hack, potentially large amount of data stolen

Citrix has been the victim of an attack by hackers, in which a large amount of data may have been stolen from customers. That’s what Forbes reports. The attack was reported to the company by the FBI on March 6.

The FBI contacted Citrix to report that international cybercriminals were likely to have gained access to the company’s internal network. In a statement Citrix says have taken action to limit the incident. “We started a forensic investigation, contacted a major security agency for assistance, took action to protect our internal network and continued to work with the FBI.”

Security company Resecurity states that the attacks were carried out by a group called IRIDIUM, which is linked to Iran. The hacker group has already attacked over 200 government agencies, oil and gas companies and tech companies. The company claims to have already contacted Citrix on 28 December last year to share an early warning about an attack and data breach. “Based on the timing and further dynamics, the attack appears to have been planned and organized over the Christmas period.”

Stolen data

Exactly how much data has been stolen is still unknown. “It seems that the hackers may have had access to and downloaded business documents,” says Citrix. “Based on its own analysis, Resecurity states that hackers have been given access to at least 6 TB of sensitive data. This includes e-mails, files and other services.

“Although it has not yet been confirmed, the FBI thinks that the hackers probably used a technique known as password spraying,” says Citrix. “That’s a technique that abuses weak passwords. According to Resecurity, the hacker group used its own techniques to get past the two-step verification for critical applications and services.

For the time being, there is no indication that the security of a Citrix product or service has been compromised.