Chinese state-sponsored hackers, notably APT10, broke into eight IT service providers including HPE, IBM, and their client networks in a years-long invasion
Eight of the world's biggest technology service providers were hacked by Chinese cyber spies in an elaborate and years-long invasion, Reuters found.
Context & Ripple Effects
Reuters' investigation hardens what sources first described in December 2018, when state-sponsored Chinese hackers were reported to have breached HPE's and IBM's networks and pivoted into their clients. Weeks earlier, the DOJ had indicted two alleged APT10 members over thefts from at least 45 US tech companies and agencies.
What the new reporting adds is scale and method: eight major technology service providers hit in a years-long campaign, with the attackers treating the providers themselves as the entry point rather than the target. That reframes the breach from a set of isolated intrusions into a supply-chain operation run through the industry's most trusted intermediaries.
First-order effects
- IBM and HPE now face direct questions from enterprise clients about how their internal networks were used as staging grounds, putting their managed-services relationships — the core of both businesses — under scrutiny.
- Clients of large IT service providers learn their exposure ran through vendor credentials and remote-access tooling, meaning their own perimeter defenses were never the deciding factor.
Second-order effects
- Rival service providers are pushed to prove segmentation between their own infrastructure and client environments, turning security architecture into a competitive differentiator in outsourcing contracts.
- Enterprise buyers gain leverage to demand audit rights, liability terms, and breach-notification guarantees from managed-service vendors, repricing trust across the sector.
Third-order effects
- If the pattern holds, espionage concentrates on the shared plumbing of cloud and outsourced IT — one compromised provider yields many victims at once, making provider concentration itself a national-security concern.
- Governments respond by treating service-provider security as procurement criteria, splitting the market between vendors cleared for sensitive workloads and those shut out of them.
The trend: State-sponsored espionage is moving upstream from individual corporate targets to the shared IT service providers that hold access to many victims simultaneously.