Hackers Were Inside Citrix for Five Months
Summary: Citrix Systems disclosed that attackers had intermittent access to its internal network from Oct. 13, 2018 to Mar. 8, 2019, taking personal and financial data on employees, contractors, interns, job candidates and their dependents. The FBI alerted Citrix in March 2019 that cybercriminals likely entered through password spraying, and the company's Feb. 10, 2020 notification letter said the stolen data may have included Social Security or tax identification numbers, driver's license and passport numbers, financial and payment card numbers, and limited health claims information.
Key Takeaway: A crude attack - a handful of common passwords tried across many employee accounts - gave intruders five months inside a company whose VPN software is used by most of the Fortune 100, and Resecurity's claim that it warned Citrix on Dec. 28, 2018, which Citrix initially denied and later acknowledged, means the window was visible before it closed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026