F5 discloses nation-state breach exposing BIG-IP source code, vulnerability data
F5 disclosed that a nation-state threat actor had long-term, persistent access to certain systems and exfiltrated files containing portions of BIG-IP source code and information about undisclosed vulnerabilities. The company says containment has been successful, it has found no evidence of software supply chain modification, and the incident has not had a material impact on operations so far, though it is still evaluating potential effects on financial condition and results. Separately, director Michael Montoya resigned from the board and was appointed Chief Technology Operations Officer.
Key points
- F5 learned of the unauthorized access on August 9, 2025; the Department of Justice delayed public disclosure on September 12, 2025.
- Exfiltrated files included portions of BIG-IP source code and information on undisclosed BIG-IP vulnerabilities; some files held configuration details for a small percentage of customers.
- F5 reports no evidence of access to its CRM, financial, support case management or iHealth systems, or of modification to its software supply chain.
- Michael Montoya resigned as a director on October 9, 2025, and took the role of Chief Technology Operations Officer effective October 13, 2025; the board shrank from eleven to ten members.
The filing
Written by AI (Anthropic Claude, claude-haiku-5-5) on Nov 8, 2026, 12:42 AM ET, from the text of the filing and its press-release exhibits only. Written later: this filing was briefed after the fact, when past filings were added to the site, so the brief may be read with hindsight; the filing itself is the record of what was known on October 15, 2025.
Briefs are written by AI from the filing text (each brief's own page names the model) and can contain mistakes — open the filing before acting on anything. Impact (1-5) and tone are the model's reading of the filing for shareholders, not a price forecast. Not investment advice.