Trellix discloses data breach after source code repository hack

Trellix, a global cybersecurity firm formed from the merger of McAfee Enterprise and FireEye, disclosed that attackers gained unauthorized access to a portion of its source code repository. The company has not found evidence that the source code was exploited or altered, but it has notified law enforcement and is working with forensic experts. The breach was detected early enough that no distribution or release of the source code was affected. Similar incidents have affected other security vendors such as Checkmarx, Cisco, and HackerOne. Trellix has not yet provided detailed information about the breach, but it will share further details once the investigation is complete. The incident underscores the importance of securing source code repositories and monitoring for unauthorized access. The breach does not appear to have impacted customer data or internal systems beyond the repository.

The article notes that the breach involved only a portion of the source code and that no evidence of exploitation was found. Trellix’s response includes notifying law enforcement, engaging forensic experts, and planning to share more details later. The company has also reviewed its security controls around the repository. The incident highlights the need for regular security reviews of source code management systems.

Security teams should conduct forensic analysis, audit repository access logs, and strengthen security controls to prevent future incidents.