LAPSUS$ Claims AstraZeneca Breach and Offers Alleged Internal Data for Sale

A threat actor using the LAPSUS$ name has claimed an alleged breach of AstraZeneca and is offering a purported 3GB compressed dump of internal data for sale rather than releasing it publicly. Posted samples and screenshots were used to support the claim, with reports describing a pay-to-access extortion model and password-protected links containing redacted material as proof of access. The allegedly stolen data includes source code, cloud infrastructure configurations, employee and contractor-related records, and access material such as cryptographic keys, Vault credentials, and GitHub and Jenkins tokens.

Analysis of the shared samples suggested that some data, including GitHub Enterprise-style user information and third-party contractor access records, appeared plausibly authentic and internally sourced, while at least one financial dataset looked generic and possibly unrelated. Public references to an internal repository tied to AstraZeneca’s supply-chain portal indicate possible exposure of systems supporting forecasting, inventory tracking, SAP integration, and OTIF delivery metrics. The most serious risk would come from any genuine secrets, private keys, or cloud configuration data, but the breach claim and full scope of the exposed material remained unverified, and AstraZeneca had not publicly confirmed the incident at the time of reporting.