Staff Data Exposure Reports' Probe Found No Systems Breach, Nor Engagement With Clients: HCL Tech

HCL Technologies (HCLTech) has said its initial investigation into reported claims by a hacker group of potential exposure of some data relating to employees has revealed that the said information may be limited and dated, and that there is no evidence of breach to its own systems or engagement with any of the company's clients.

HCLTech, however, added it is undertaking further investigation, and assured that any material findings in this regard will be reported.

"This is with reference to some media alerts regarding claims made by a hacker group of potential exposure of limited data elements relating to HCLTech employees. In this regard, this is to clarify that the company’s initial investigation has revealed that the aforesaid data may be limited and dated to a few years back," HCLTech said in a BSE filing late Monday evening.

There is no evidence of breach to the systems or engagement with any of the clients, the filing further informed.

"The company, however, is undertaking further investigation, and any material findings in this regard will be reported. The company considers cyber security as its top priority and remains committed to protecting the information entrusted to it," it said.

It is pertinent to mention here that Tata Consultancy Services (TCS) on Monday said it had received threat-intelligence alerts alleging possible exposure of certain employee information, but added that upon investigation into the matter it has not found any credible evidence of a breach of systems or customer environments.

In a BSE filing, India's largest IT services company had said that the information referenced appears to be more than four years old and limited to basic employee information. There is no indication that customer data, customer systems, or TCS' operational systems have been impacted, it had emphasised.

"This is to inform you that company has received threat-intelligence alerts alleging possible exposure of certain employee information. The company has investigated the matter and has not found any credible evidence of a breach of TCS systems or customer environments," TCS filing had said.

According to TCS, the attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector. TCS further said it has had strong safeguards in place against such techniques for more than two years.

"Based on the current review, these controls remain effective, and the company continues to monitor the environment closely," TCS had said.

TCS will continue to assess any new information that becomes available and take appropriate action, if required, the company said, assuring that it is committed to maintaining the security and resilience of systems and to protecting information.