F5 Breach Exposes BIG-IP Source Code — Nation-State Hackers Behind Massive Intrusion

F5 has disclosed that unidentified threat actors breached its systems and stole files containing some of BIG-IP’s source code and information related to undisclosed vulnerabilities in the product. According to the company, the activity was attributed to a “highly sophisticated nation-state threat actor,” a claim it has made about the adversary’s long‑term, persistent access to its network. It learned of the breach on 9 August 2025, per a Form 8-K filing with the U.S. Securities and Exchange Commission.

F5 said it has taken extensive actions to contain the threat and that, since beginning these measures, it has not seen any new unauthorized activity and believes containment has been successful.

The firm did not say how long the attackers had access to its BIG-IP development environment, but noted that vulnerabilities were not exploited in a malicious context, and that access to its CRM, financial, and other systems was not gained; some exfiltrated files from its knowledge management platform contained configuration or implementation information for a small percentage of customers.