Nokia investigates unauthorized access to its data through one of its external contractors

Nokia is investigating the unauthorized access of a malicious agent to internal company information through one of its external contractors, which has resulted in the theft of data belonging to the technology company, such as RSA keys and mail transfer protocol accounts (SMTP).

The cyber threat actor who has claimed responsibility for the attack is IntelBroker which in February of this same year partially leaked a database with Facebook Marketplace user records with identifying data of the victims. In June it was also revealed that it had put up for sale data that was promoted as belonging to AMD employees and products.

Now, this cybercriminal has claimed to Bleeping Computer that he has accessed Nokia’s third-party vendor’s SonarQube server using default credentials. Thus, it has managed to download Python projects from clients, including those of the Finnish company.

He has indicated on a piracy forum known as Breach Forums that he had put it up for sale “a large collection of Nokia source code” which he obtained from a third-party contractor who worked directly with Nokia to assist in the development of some internal tools.

It has also specified that the stolen data contains keys for the Secure Shell (SSH) network protocol, RSA keys, BitBucket logins, SMTP accounts, webhooks and encrypted or embedded credentials.

The technological has launched an investigation to clarify whether the security of its system has been violated and has told said media that “it is aware of reports” indicating that this unauthorized actor has supposedly had access to this information. However, it has said that “to date” it has found no evidence that any of its systems or data have been affected by this alleged attack.

The aforementioned medium has also recalled that other cybersecurity incidents related to IntelBroker are the attacks on Hewlett Packard Enterprise (HPE) or Weee! Furthermore, this hacker has leaked data from companies like T-Mobile and Apple, also stolen from an external software as a service (SaaS) provider.