F5 breach exposes 262,000 BIG-IP systems worldwide

Over 262,000 F5 BIG-IP devices were exposed online after F5 confirmed a breach by a nation-state actor who stole BIG-IP source code and data on undisclosed vulnerabilities. The Shadowserver Foundation found 262,269 BIG-IP systems exposed online, with over 130,000 in the US; it remains unclear how many have been secured against exploitation of the disclosed flaws.

In mid-October, F5 disclosed that the breach occurred in August 2025 and involved access to the company’s BIG-IP development and engineering systems; containment was successful and no further unauthorized activity was observed. The company reported the incident to law enforcement and is investigating with the help of leading cybersecurity firms, noting some stolen files contained limited customer configuration data.

F5 rotated credentials, tightened access controls, automated patch management and enhanced monitoring as part of its response, and partnered with CrowdStrike to deploy Falcon EDR while offering customers a free EDR subscription. UK’s NCSC and US CISA advise F5 customers to locate all products, secure exposed management interfaces, assess for compromise, and acknowledge that F5 delayed disclosure at the US government’s request; privately, F5 linked the breach to the China-nexus group UNC5221. According to the U.S. Securities and Exchange Commission (SEC), F5 filed a Form 8-K reporting the incident.