A sophisticated nation-state actor breached F5 systems, stealing BIG-IP source code and data on undisclosed flaw

F5 disclosed that a highly sophisticated nation-state actor breached its systems, stealing BIG-IP source code and information related to undisclosed vulnerabilities. The attackers accessed the BIG-IP development and engineering systems, and F5 says containment efforts were successful with no further unauthorized activity observed.

The company noted that some stolen files contained limited customer configuration data, and it is notifying impacted clients while continuing investigations with leading cybersecurity firms. F5 rotated credentials, tightened access controls, automated patch management, and improved monitoring and network security in response, and engaged CrowdStrike to deploy Falcon EDR and threat hunting for BIG-IP. According to the U.S.

Securities and Exchange Commission (SEC), the incident was first learned on August 9, 2025, and UK’s NCSC and US CISA advise customers to locate all F5 products, secure exposed management interfaces, and assess for compromise, with F5 delaying disclosure at the government’s request to protect critical systems.