Cybersecurity Breach at F5 Attributed to Chinese State Hackers

In October 2025, F5 Inc., a U.S.-based cybersecurity firm, disclosed a significant breach attributed to state-sponsored hackers believed to be linked to China. The attackers gained "long-term, persistent access" to F5's systems, particularly its BIG-IP product development environment, for at least 12 months. During this time, they exfiltrated sensitive files, including portions of the BIG-IP source code and information on undisclosed vulnerabilities.

Silicon RepublicF5 Cybersecurity Breach Linked to China-Backed Nation-State Threat ActorsChinese state hackers prime suspects in F5 breachF5 Says Nation-State Hackers Stole Source Code and Vulnerability DataCityLabF5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue AlertsF5 Inc. Data Breach Blamed on China Sparks ‘Catastrophic’ Cybersecurity ConcernsF5 Cybersecurity Breach: China-Linked Hackers Expose Critical Vulnerabilities in U.S. Networks

F5 first detected unauthorized access on August 9, 2025, and subsequently reported the incident to the U.S. Securities and Exchange Commission. The breach has raised alarms among cybersecurity agencies, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issuing an emergency directive for federal agencies to update their F5 technology by October 22, 2025. The breach is particularly concerning as F5's products are integral to the IT infrastructure of many Fortune 500 companies and government agencies.

F5 Cybersecurity Breach: China-Linked Hackers Expose Critical Vulnerabilities in U.S. NetworksCityLabPotentially ‘Catastrophic’ Cyber Firm Breach Blamed on ChinaF5 discloses breach; Bloomberg cites suspected China linkBloomberg: China Blamed for Breach at US Cybersecurity Firm F5F5 Cybersecurity Breach Linked to China-Backed Nation-State Threat ActorsBreach at US-based cybersecurity provider F5 blamed on China, Bloomberg News reportsExpress TribuneF5 Inc. Data Breach Blamed on China Sparks ‘Catastrophic’ Cybersecurity Concerns

CISA has warned that the breach poses an "imminent threat" to federal networks utilizing F5 products. The agency highlighted that the stolen source code and vulnerability information could enable attackers to exploit F5 devices, potentially leading to unauthorized access to sensitive data and lateral movement within networks. The UK’s National Cyber Security Centre (NCSC) echoed these concerns, advising organizations to assess their F5 products for potential compromises.

F5 Cybersecurity Breach: China-Linked Hackers Expose Critical Vulnerabilities in U.S. NetworksPotentially ‘Catastrophic’ Cyber Firm Breach Blamed on ChinaF5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue AlertsCityLabBloomberg: China Blamed for Breach at US Cybersecurity Firm F5F5 Cybersecurity Breach Linked to China-Backed Nation-State Threat ActorsSilicon Republic

F5 has engaged external cybersecurity firms, including CrowdStrike and Mandiant, to assist in investigating the breach and securing its systems. The company has communicated with its customers, providing a threat-hunting guide focused on a malware variant known as Brickstorm, which is believed to be linked to the attackers. F5's CEO, François Locoh-Donou, has been personally briefing customers about the breach and its implications.

Bloomberg: China Blamed for Breach at US Cybersecurity Firm F5Express TribuneBreach at US-based cybersecurity provider F5 blamed on China, Bloomberg News reportsF5 Cybersecurity Breach: China-Linked Hackers Expose Critical Vulnerabilities in U.S. NetworksF5 Cybersecurity Breach Linked to China-Backed Nation-State Threat ActorsPotentially ‘Catastrophic’ Cyber Firm Breach Blamed on ChinaSilicon RepublicCityLab

While F5 has not publicly named the attackers, multiple reports, including those from Bloomberg and SecurityWeek, suggest a strong link to Chinese state-sponsored hackers. The Chinese government has denied involvement, with officials asserting that China opposes hacking activities. This denial contrasts with the assessments of U.S. cybersecurity experts, who have noted the sophistication of the attack and its alignment with previous Chinese cyber espionage campaigns.

F5 Says Nation-State Hackers Stole Source Code and Vulnerability DataBloomberg: China Blamed for Breach at US Cybersecurity Firm F5CityLabExpress TribunePotentially ‘Catastrophic’ Cyber Firm Breach Blamed on ChinaBreach at US-based cybersecurity provider F5 blamed on China, Bloomberg News reportsF5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue AlertsF5 Cybersecurity Breach Linked to China-Backed Nation-State Threat ActorsF5 Inc. Data Breach Blamed on China Sparks ‘Catastrophic’ Cybersecurity Concerns

Despite the attribution to Chinese hackers, F5 has stated that it has no evidence of critical vulnerabilities being exploited or modifications made to its software supply chain. The company has not confirmed any data theft from its customer relationship management or financial systems, although it acknowledged that configuration data for a small percentage of customers was accessed.

F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data

In light of the breach, organizations using F5 products are urged to implement immediate security updates and enhance their cybersecurity protocols. The incident has prompted discussions about the need for improved vendor risk management and the importance of rapid patching in the face of evolving cyber threats. As investigations continue, the broader implications for supply chain security and the cybersecurity landscape are likely to unfold in the coming months.

Bloomberg: China Blamed for Breach at US Cybersecurity Firm F5