Article
F5 breach: when your security vendor is hacked
The F5 breach shows how a vendor hack becomes customer risk. See what was taken, what CISA and the NCSC advised, and which checks…
Read more
Significant cyber incident
F5 nation-state breach
On 15 October 2025 F5, a maker of network and application delivery products, told the US SEC that a nation-state threat actor had long-term access to its BIG-IP development environment.
In short
On 15 October 2025 F5, a maker of network and application delivery products, told the US SEC that a nation-state threat actor had long-term access to its BIG-IP development environment. F5 says the actor took files with part of the BIG-IP source code, information about undisclosed flaws, and configuration data for a small percentage of customers. CISA issued Emergency Directive 26-01 the same day because the stolen code could help find and exploit flaws in F5 devices.
What happened
F5 says it learned on 9 August 2025 that a highly sophisticated nation-state threat actor had gained unauthorized access to some of its systems. The actor kept long-term, persistent access, including to the BIG-IP product development environment and the engineering knowledge management platform.
Files were taken. F5 says some held portions of BIG-IP source code and information about undisclosed BIG-IP vulnerabilities it was working on. Some files from the knowledge platform also held configuration or implementation details for a small percentage of customers.
F5 reported the incident on 15 October 2025, after the US Department of Justice determined on 12 September 2025 that a delay was warranted. F5 says it has no evidence of changes to its source code or build and release pipelines, and no evidence of access to its CRM, financial, support case or iHealth systems.
Timeline
-
2025-08-09
F5 learns that a nation-state threat actor had gained unauthorized access to some of its systems.
-
August 2025
F5 starts incident response, contains the actor and brings in outside experts.
-
2025-09-12
The US Department of Justice determines that a delay in public disclosure is warranted under Item 1.05(c) of Form 8-K.
-
2025-10-15
F5 files its 8-K with the SEC and posts a disclosure statement for customers on MyF5.
-
2025-10-15
F5 releases updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ and APM clients.
-
2025-10-15
CISA issues Emergency Directive 26-01 for federal civilian agencies.
-
2025-10-15
The UK NCSC publishes its alert "Confirmed compromise of F5 network".
-
2025-10-15
FedRAMP tells cloud providers how to respond to the directive.
-
2025-10-22
Deadline for federal agencies to apply the latest updates to F5OS, TMOS, BIG-IQ and BNK/CNF.
-
2025-10-27
F5 reports Q4 results and expects some near-term disruption to sales cycles.
-
2025-10-29
Deadline for agencies to report a summary of F5 products in scope to CISA.
-
2025-10-31
Deadline for agencies to update the remaining F5 devices.
-
2025-12-03
Deadline for agencies to report a detailed inventory of F5 products to CISA.
-
2026-03-01
CISA due to report to senior officials on implementation of the directive.
How the attack worked
What the public sources say
F5 and CISA describe the outcome, not the entry method. No opened source states how the actor first got in, which tools it used, or how it moved inside F5. F5 says only that the actor kept long-term, persistent access and downloaded files from the BIG-IP product development environment and the engineering knowledge management platform.
Why stolen source code matters
CISA says access to proprietary source code could give the actor a technical advantage. It could allow static and dynamic analysis to find logic flaws and zero-day vulnerabilities, and the development of targeted exploits.
What a later exploit could do
CISA says successful exploitation of the affected F5 products could expose embedded credentials and API keys. It could also let an actor move laterally, steal data and keep persistent access, and could lead to full compromise of target systems.
What F5 says was not touched
F5 reports no evidence of changes to its source code or build and release pipelines, validated by independent firms. It also reports no evidence of access to CRM, financial, support case management or iHealth systems, or to NGINX source code, F5 Distributed Cloud Services or Silverline.
Who says who was behind it
No public attribution to a named group or country. F5 (8-K, 15 October 2025) calls the actor a "highly sophisticated nation-state threat actor". CISA (ED 26-01, 15 October 2025) calls it a "nation-state affiliated cyber threat actor". The NCSC statement of 15 October 2025 names no actor. The opened sources do not differ on this point.
Impact
Stolen data, as F5 states it: files holding some BIG-IP source code and information about undisclosed BIG-IP vulnerabilities, plus configuration or implementation information for a small percentage of customers.
F5 says it knew of no undisclosed critical or remote code vulnerabilities and no active exploitation of undisclosed F5 vulnerabilities (15 October 2025).
F5 says it found no evidence of changes to its source code or build and release pipelines, and no evidence of access to CRM, financial, support case management or iHealth systems, NGINX, F5 Distributed Cloud Services or Silverline.
On 15 October 2025 F5 said there was no material impact on operations and it was still evaluating financial effects.
On 27 October 2025 F5 said it expected near-term disruption to sales cycles and guided fiscal 2026 revenue growth of 0% to 4%, with demand impacts more pronounced in the first half.
The NCSC said there was no indication that any customer networks had been affected through the F5 compromise (15 October 2025).
CISA called the actor an imminent threat to federal networks that use F5 devices and software.
Government and regulator response
- 12 September 2025, US Department of Justice: determined that delaying public disclosure was warranted under Item 1.05(c) of Form 8-K.
- 15 October 2025, F5: filed an 8-K, posted a customer disclosure statement, released updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ and APM clients, and offered a threat hunting guide, hardening checks in iHealth and SIEM logging guidance. F5 says it rotated credentials, strengthened access controls, hardened its development environment, and continues code review and penetration testing with independent firms. It engaged outside security firms and offered supported customers a free EDR subscription that ran through 14 October 2026.
- 15 October 2025, CISA: issued Emergency Directive 26-01. Agencies must inventory F5 products, check management interfaces for internet exposure, update by 22 October (key products) or 31 October (others), disconnect end-of-support public-facing devices, and report to CISA by 29 October and 3 December 2025.
- 15 October 2025, UK NCSC: advised following F5 guidance, installing updates, keeping management interfaces off the internet, replacing unsupported products, and continuous monitoring and threat hunting.
- 15 October 2025, FedRAMP: asked authorized cloud providers to check for affected devices, act by 22 October 2025 and upload documentation by 24 October 2025.
Lessons
-
Vendor breaches become customer risk
The stolen material was the vendor's source code and flaw research. CISA says this could help an actor find zero-days and build targeted exploits against devices customers run.
-
Know every device you run
CISA's first order was to inventory all BIG-IP hardware and software. Organizations that could not list their F5 assets could not start.
-
Management interfaces should not face the internet
CISA and the NCSC both focus on whether management interfaces are reachable from the public internet.
-
End-of-support devices are a liability
CISA ordered public-facing end-of-support F5 devices to be disconnected, and the NCSC advised replacing them.
-
Disclosure can be delayed on purpose
The Department of Justice allowed a delay from 12 September to 15 October 2025. Customers learned about the risk weeks after F5 did.
-
Plan patching for a short window
Federal agencies had days, not months: 22 October 2025 for key products. Patch and verification steps need to be ready before the notice arrives.
What to check in your own organization
-
Inventory of F5 products
List every BIG-IP hardware, virtual and software instance, including F5OS, TMOS, BIG-IQ and BIG-IP Next, and who owns each.
-
Management interface exposure
Check whether any BIG-IP management interface is reachable from the internet. If one is, run a compromise assessment, as the NCSC advises.
-
Patch level
Confirm the latest F5 updates are applied and that downloaded images are checked against F5's published checksums before install.
-
End-of-support devices
Find F5 devices past end of support and set a date to replace or disconnect them.
-
Logging to your SIEM
Check that BIG-IP events are sent to your SIEM so admin logins, failed logins and configuration changes are visible, as F5 recommends.
-
Embedded secrets
Find credentials and API keys stored on F5 devices and rotate them, since CISA lists them as a risk if the devices are later exploited.
-
Vendor notice process
Check who receives vendor security notices and how fast you can decide, test and deploy an emergency update.
-
Customer data held by the vendor
Ask which configuration files you shared with F5 support and whether F5 has contacted you about them.
Where it happened
Questions
What did the attackers take from F5?
F5 says files containing some BIG-IP source code and information about undisclosed BIG-IP vulnerabilities, plus configuration or implementation data for a small percentage of customers.
Who was behind it?
No public attribution. F5 and CISA describe a nation-state or nation-state affiliated actor and name no group or country.
Was F5's software changed to include malicious code?
F5 says it has no evidence of modification to its source code or build and release pipelines, and says independent firms validated that assessment.
Why did CISA issue an emergency directive?
CISA says the stolen code could help the actor find zero-day flaws and build targeted exploits, and called the actor an imminent threat to federal networks using F5 devices.
Why was the breach made public in October if F5 knew in August?
F5 learned of it on 9 August 2025. The US Department of Justice determined on 12 September 2025 that a delay in disclosure was warranted. F5 reported on 15 October 2025.
Were customer networks hit?
The NCSC said on 15 October 2025 there was no indication that customer networks had been affected through the F5 compromise.
In our research
- F5 breach: when your security vendor is hacked October 2026
- Cyber incidents of 2026: lessons from official reports October 2026
- Salt Typhoon: what telecom customers should do October 2026
- Bybit theft: what it teaches about supplier access October 2026
- How Nation-State Cyber Threats Are Evolving – Part II August 2025
- F5 BIG-IP Security Vulnerability Allows Remote Code Execution: CVE-2023-46747 October 2023
Sources
- F5, Inc. Form 8-K, 15 October 2025 (Item 1.05 Material Cybersecurity Incidents) U.S. Securities and Exchange Commission (filed by F5, Inc.)
- F5 Security Incident: Disclosure Statement (Exhibit 99.1 to the 8-K) F5, Inc. via U.S. Securities and Exchange Commission
- ED 26-01: Mitigate Vulnerabilities in F5 Devices Cybersecurity and Infrastructure Security Agency (CISA)
- Confirmed compromise of F5 network National Cyber Security Centre (UK)
- Responding to CISA Emergency Directive 26-01 FedRAMP (U.S. General Services Administration)
- F5 Q4 FY25 Earnings Release, 27 October 2025 (Exhibit 99.1) F5, Inc. via U.S. Securities and Exchange Commission
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.