CrowdStrike fires ‘suspicious insider’ who passed information to hackers

Cybersecurity giant CrowdStrike confirmed last month that it had fired a “suspicious insider” who allegedly passed company information to a notorious hacking group.

A hacker collective known as Scattered Lapsus$ Hunters posted screenshots Thursday and Friday morning on a public Telegram channel that allegedly showed internal access to CrowdStrike systems. Screenshots TechCrunch has seen show dashboards containing links to company resources, including a user’s Okta dashboard used by employees to access internal applications.

The hackers claimed on the Telegram channel that they compromised CrowdStrike through a recent breach at Gainsight, a customer relationship management company that helps Salesforce customers track and manage their own customer data. The hackers said they used information stolen from Gainsight to break into CrowdStrike.

But CrowdStrike says the hackers’ claims are “false” and says it terminated the insider’s access after the company “determined he was sharing photos of his computer screen externally.”

“Our systems were never compromised and customers remained protected throughout. We have referred the matter to appropriate law enforcement,” CrowdStrike spokesperson Kevin Benacci told TechCrunch.

Several other tech companies were reportedly hacked in the same campaign. Gainsight did not respond to TechCrunch’s requests for comment.

Scattered Lapsus$ Hunters is a hacker collective made up of several hacker groups, including ShinyHunters, Scattered Spider, and Lapsus$. Group members use social engineering techniques to trick employees into granting them access to their systems or databases.

In October, Scattered Lapsus$ Hunters claimed to have stolen more than a billion records from enterprise giants who rely on Salesforce to house their customer data. Hackers have published a data leak site listing data stolen from companies including insurance giant Allianz Life, airline Qantas, automaker Stellantis, credit agency TransUnion and employee management platform Workday, among others.