Breach of the giant Wipro computer network – Krebs on Security

Indian Giant of Outsourcing and Information Technology Consulting (IT) Wipro Ltd. [NYSE:WIT] investigating reports that its own computer systems have been hacked and are used to launch attacks against some of the company's customers, several sources told KrebsOnSecurity. Wipro declined to answer questions regarding the alleged incident.

Earlier this month, KrebsOnSecurity heard, independently of two reliable sources, that Wipro, India's third-largest IT outsourcing company, was facing a month-long intrusion by an alleged attacker sponsored by the state.

Both sources, who requested anonymity, said Wipro systems were used as a starting point for digital fishing expeditions targeting at least a dozen Wipro client systems.

Security experts said Wipro's customers traced malicious and suspicious network discovery activities to partner systems that communicate directly with Wipro's network.

On April 9, KrebsOnSecurity sought the advice of Wipro. This caused an email on April 10 of Vipin Nair, Wipro Communications Manager. Nair stated that he was traveling and needed a few days to gather more information before giving an official response.

On Friday, April 12, Nair sent a statement in which he did not recognize any of the questions asked of Wipro regarding an alleged security incident related to attacks on his own customers.

"Wipro has a multilayer security system," writes the company. "The company has robust internal processes and an advanced security technology system to detect phishing attempts and to protect against such attacks. We continually monitor our entire infrastructure with a high level of vigilance to deal with any potential cyber threat. "

Wipro has not responded to several additional requests for comments. Since then, two other sources familiar with the investigation have come forward to confirm the outlines of the incident described above.

A source close to the forensic investigation at a Wipro client said that it appears that at least 11 other companies have been attacked, as evidenced by the files found on the backbone infrastructure of intruders, named after different Wipro customers. This source refused to name the other customers.

The other source said Wipro was setting up a new private messaging network because it was thought that the intruders had compromised Wipro's corporate messaging system for a while. The source also said that Wipro now informs its concerned customers of specific "compromise" indicators, indicating to them tactics, tools and procedures used by perverts that could indicate a successful intrusion attempt.

Wipro claims to have more than 170,000 employees serving customers across six continents, as well as Fortune 500 customers in the healthcare, banking, communications and other sectors. In March 2018, Wipro claimed to have crossed the $ 8 billion mark in annual IT services revenue.

The apparent breach comes amid the changing fortunes of Wipro. On March 5th, the State of Nebraska suddenly canceled a contract with Wipro after spending $ 6 million with the company. In September 2018, the Nebraska Department of Health and Social Services sent a letter to stop and refrain from Wipro, ordering it to stop working on improving the Medicaid registration system, and to leave his offices. Wipro is now suing Nebraska, saying its project is on time and on budget.

In August 2018, Wipro disbursed $ 75 million to settle a lawsuit over a botched SAP implementation that would have cost hundreds of millions of dollars to repair at the US National Grid.

Another curious development, even if it is only a coincidence, on April 4, 2019, the Indian government has sold "enemy" shares of Wipro worth about $ 166 million. According to this article The commercial standardThe enemy shares are so named because they were originally owned by people who emigrated to Pakistan or China and are no longer Indian citizens.

"A total of 44.4 million shares, which were held by the custodian of the enemy property for India, were sold at Rs.259 each on the Bombay Stock Exchange," The Business Standard reported. "The buyers were the state-owned Life Insurance Corporation of India (LIC), New India Insurance and General Insurance Corporation. LIC "

Wipro is expected to announce its fourth quarter results report on Tuesday, April 16 (PDF).

Tags: Wipro data breach