CrowdStrike fires ‘suspected insiders’ who provided information to hackers

Cybersecurity giant CrowdStrike has confirmed it fired a “suspected insider” last month who allegedly fed information about the company to a notorious hacking group.

A hacking group known as the Scattered Lapsus$ Hunters posted screenshots late Thursday and early Friday morning to a public Telegram channel that allegedly showed insider access to CrowdStrike systems. The screenshots, seen by TechCrunch, show dashboards containing links to company resources, including the single-user Okta dashboard used by employees to access internal apps.

The hackers claimed on their Telegram channel that they breached CrowdStrike through a recent breach at Gainsight, a customer relationship management company that helps Salesforce customers track and manage their own customer data. The hackers said they used information stolen from Gainsight to break into CrowdStrike.

However, CrowdStrike says the hacker’s claims are “false” and says it cut off the insider’s access after the company “determined he shared photos of his computer screen externally.”

“Our systems were never compromised and customers remained protected throughout. We have turned the matter over to the appropriate law enforcement authorities,” CrowdStrike spokesperson Kevin Benacci told TechCrunch.

Several other tech companies were reportedly hacked as part of the same campaign. Gainsight did not respond to TechCrunch’s requests for comment.

Scattered Lapsus$ Hunters is a hacker collective consisting of various hacking groups, mainly ShinyHunters, Scattered Spider and Lapsus$. Team members use social engineering techniques to trick employees into granting them access to their systems or databases.

In October, the Scattered Lapsus$ Hunters claimed to have stolen over 1 billion records from enterprise giants that rely on Salesforce to host their customers’ data. Hackers published a data breach website with data stolen from companies including insurance giant Allianz Life, airline Qantas, carmaker Stellantis, credit bureau TransUnion, employee management platform Workday and others.