Rich Tehrani

Alleged Hidden Cloud Breaches Reveal IBM, AT&T Security Failures

Hidden Cloud Breaches Alleged at IBM, AT&T The allegations now facing International Business Machines Corp and AT&T Inc did not surface overnight. They arrived wrapped inside a False Claims Act complaint that had been sitting under seal since 2020, finally unsealed this week after the US government chose not to intervene. The suit, filed by a former vice president of threat intelligence, paints a picture of long-running security failures, repeated intrusions, and what the complaint describes as deliberate downplaying of breach severity before major federal contracting decisions. The scale of the network at issue underscores the severity of the allegations. IBM’s cloud computing infrastructure serves as a backbone environment across government agencies, including military customers. AT&T operates the Core Network that supports it. Allegations that both companies faced intrusions they could not fully trace point toward systemic exposure. The complaint describes foreign and unidentified hackers repeatedly breaching the Core Network, sometimes without the companies being able to determine who accessed what, or whether any data had been exfiltrated or altered. Chinese government-backed groups, including APT 10, are explicitly referenced. An IBM spokesperson responded that the complaint was filed six years ago and reaffirmed that the company believed its actions followed the letter of the law. AT&T declined to comment. The whistleblower claims to have witnessed numerous incidents while serving in senior cybersecurity roles between 2017 and 2019, alleging pressure to soften internal reporting. According to the suit, internal investigations uncovered more than 50,000 potential APT 10 hits between 2013 and 2016 and later found nearly 400 compromised accounts across almost 200 systems in 18 countries. These findings allegedly collided with weak logging practices that prevented deeper forensic work. If accurate, the situation echoes warnings from long-standing federal guidance. For example, the NIST discussion on incident reporting in NIST SP 800-150 highlights how inadequate logs allow adversaries to persist for years. Questions about transparency have surfaced before for both companies in different contexts. IBM agreed in 2020 to pay $900,000 to resolve US Defense Department claims that it had not properly secured systems tied to earlier hacking activity. Separately, AT&T has long been under a different kind of whistleblower spotlight stemming from a former technician's disclosures that AT&T operated a splitter facility giving the NSA access to backbone traffic, a case that resurfaced in public analysis from the Electronic Frontier Foundation in 2025. These examples form a pattern of how sensitive infrastructure has historically been handled. https://t.co/Z5o56NhCa5