Incident
incident:ubiquiti_breach
Also: Ubiquiti breach incident, Ubiquiti cyber-attack
Unauthorized access and data theft incident involving Ubiquiti's cloud systems, GitHub repositories, and internal data.
Unauthorized access and data theft incident involving Ubiquiti's cloud systems, GitHub repositories, and internal data.
“Somebody has been poking around where they shouldn’t have, and data has been exfiltrated”
“Whistleblower: Ubiquiti Breach Catastrophic”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | Ubiquiti | Explicit | 178 |
| outgoing | INVOLVES | Nickolas Sharp | Explicit | 178 |
| outgoing | INVOLVES | Data exfiltration | Explicit | 178 |
| outgoing | INVOLVES | log deletion | Explicit | 178 |
| outgoing | INVOLVES | MacBook | Explicit | 178 |
| outgoing | INVOLVES | MAC address | Explicit | 178 |
| outgoing | INVOLVES | IP address | Explicit | 178 |
Ubiquiti breach COMPROMISES Ubiquiti
The breach involved unauthorized access to Ubiquiti systems and theft of company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Somebody has been poking around where they shouldn’t have, and data has been exfiltrated”
Ubiquiti breach INVOLVES Nickolas Sharp
The episode presents Nickolas Sharp as the insider responsible for carrying out the Ubiquiti breach; he later admitted the plan.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“In February 2023 he pleads guilty to three counts”
“Nick admits that it was all planned for financial gain.”
Ubiquiti breach INVOLVES Data exfiltration
The Ubiquiti breach involved exfiltration of private repositories and other confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“data has been exfiltrated”
“he’s cloned and downloaded over 100 repositories”
Ubiquiti breach INVOLVES log deletion
The breach involved Nick’s deletion or attempted deletion of AWS logs to conceal activity.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“This will delete the logs”
Ubiquiti breach INVOLVES MacBook
Forensics linked a MacBook connected to Nick’s router with the large data transfer during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“a MacBook laptop was used to connect to the router”
Ubiquiti breach INVOLVES MAC address
Investigators used MAC-address information from the home router to identify the device involved in the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“they can see which MAC address connected to that Ubiquiti router”
Ubiquiti breach INVOLVES IP address
The investigation involved matching Nick’s home IP address with the IP address used in the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“His home IP address was found in the investigation”
“the IPs match”