IBM, AT&T accused by whistleblower of covering up foreign hacks

International Business Machines Corp. and AT&T Inc.’s computer systems were repeatedly breached by foreign hackers, and the companies concealed those intrusions from the US government in violation of the law, according to a lawsuit from a former IBM cybersecurity official. William Barlow, IBM’s former vice president of threat intelligence, alleged in the complaint that the companies failed to disclose multiple breaches over years by attackers linked to foreign governments and made false assurances about the security of their systems in order to win and keep federal contracts. The whistleblower complaint against IBM and AT&T was filed under seal in 2020 and is still pending before a federal court in New York. It was made public this week, after the US government declined to intervene in the case, and hasn’t been previously reported. The suit offers a rare account of alleged security failures at two major government contractors. It raises questions about the protection of sensitive information on the networks, and about companies’ responsibility to disclose such compromises. The hackers allegedly breached massive IBM cloud computing infrastructure that’s widely used by many parts of the US government, including the military. AT&T operates this “Core Network” on behalf of IBM, and the Dallas-based telecommunications company’s systems are part of them, according to the complaint. The complaint alleges that foreign and unidentified hackers repeatedly infiltrated the network and that the companies sometimes couldn’t determine who got in, or what was taken. It also says IBM downplayed or concealed incidents before entering government agreements requiring it to certify it had no significant unresolved cybersecurity issues. “This complaint was filed six years ago, and the US Department of Justice declined to intervene,” said IBM spokesperson Adam Pratt. “IBM is confident that our actions followed the letter of the law.” Representatives of AT&T didn’t respond to requests for