Loading story…
AMD said it is investigating claims that its internal network was breached after the threat actor IntelBroker advertised a large cache of alleged company data for sale on a cybercrime forum. Reported samples indicate the material may include future product details, source code, firmware, internal communications, financial records, customer databases, and employee information, raising concerns over intellectual property exposure, corporate espionage, and privacy risks. AMD said it is working with law enforcement and a third-party hosting partner to determine whether the data is authentic and to assess the scope and impact of the incident.
The AMD claims fit a broader pattern of high-profile extortion and data-theft allegations tied to forum-based actors, including earlier reports in which attackers claimed to possess sensitive files from major organizations such as GE and even purported DARPA-related material, though some of those assertions remained unconfirmed. In AMD's case, public reporting indicates the stolen dataset was promoted on the dark web and may contain strategically valuable engineering and business information, making the incident significant even before full verification is complete.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
AMD said it was investigating the breach claims and working with law enforcement and a third-party hosting partner to assess the incident and the significance of the allegedly stolen data. The company acknowledged the reports but did not confirm the full scope of any compromise.
IntelBroker publicly claimed to have breached AMD's internal network and offered allegedly stolen data for sale on a cybercrime forum. The advertised material reportedly included future product details, source code, firmware, internal communications, financial records, customer databases, and employee information.
A threat actor identified as IntelBroker claimed to have stolen data from GE and advertised the material online, including alleged DARPA-related files. The theft remained unconfirmed at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcethecyberexpress.com
Open sourcecpomagazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actor **IntelBroker** claimed to have breached Apple and posted code on BreachForums tied to three internal tools: `AppleConnect-SSO`, `Apple-HWE-Confluence-Advanced`, and `AppleMacroPlugin`. Reporting said the exposed material appeared related to Apple’s internal authentication and workflow environment, including integrations for Atlassian Jira and Confluence, raising concern that the leak could reveal sensitive implementation details useful for follow-on attacks. Apple had not confirmed a breach at the time of reporting, and major outlets had not independently verified the claim. Independent analysis cited in coverage said the leak did **not** appear to contain the full source code for the named internal tools, but rather proprietary plugins and configuration data used to connect Apple authentication systems to internal collaboration platforms. That assessment said the exposure could still create meaningful enterprise security risk by disclosing internal architecture and access-related details, while indicating that Apple customer products and services were not affected. The claim emerged shortly after IntelBroker also alleged a breach of AMD, and later reporting noted Cisco was also claimed as a victim by the same actor.
Jun 29, 2026
Analog Devices disclosed that an unauthorized party accessed certain internal systems and exfiltrated some company files, prompting the semiconductor company to activate incident response procedures, engage external cybersecurity experts, and notify law enforcement. The company said it detected the intrusion on June 23 and later reported the incident in an SEC Form 8-K, adding that it is still determining the scope of the breach and the type of data affected. The company said it has not observed stolen data being leaked or used fraudulently and does not currently expect the incident to materially affect operations or its financial condition. Analog Devices also said it is evaluating a separate cybersecurity matter that became public in late July, while an extortion group known as **ExfilSquad** separately claimed on its leak site to have stolen roughly **570,000 customer records**; the company has not linked that claim to the disclosed breach, and the allegation remains unverified.
Aug 2, 2026
Microsoft disclosed and patched **CVE-2023-20588**, an AMD processor information disclosure vulnerability known as **AMD Speculative Leaks**, after including mitigations in its December 2023 security updates. The flaw affects multiple AMD CPU families, including **EPYC**, **Athlon**, and **Ryzen 3000-series** processors, and stems from divide-by-zero behavior that can cause the processor to transiently return random or stale data during speculative execution. The issue requires **local access** to exploit, but it was treated as a high-severity risk because sensitive data could be exposed from affected systems. Microsoft and CSIRT.SK said the vulnerability was identified by researchers from **Microsoft Azure Research** and **Vrije Universiteit Amsterdam**, and they urged organizations to apply Windows updates promptly. Guidance also advised developers to avoid using privileged data in divide-by-zero operations and to follow secure coding practices to reduce exposure.
Jul 24, 2026