F5 data breach (2025): a nation-state actor stole BIG-IP source code and vulnerability details
F5 makes the BIG-IP load balancers and application gateways that sit at the edge of many government and enterprise networks. When it disclosed that a nation-state actor had taken source code and details of unpatched bugs, CISA issued an emergency directive the same day. This is the running record of what F5 confirmed, what CISA ordered, and what is still only reported.
Short answer
Was F5 hacked?
Yes. On 15 October 2025 F5 disclosed that a “highly sophisticated nation-state threat actor” had long-term, persistent access to some of its systems, including the BIG-IP product development environment and an engineering knowledge platform, and downloaded files. F5 said it learned of the access on 9 August 2025 and delayed disclosure at the US Department of Justice’s request.
The stolen files included some BIG-IP source code and information about vulnerabilities F5 had not yet published. F5 said its CRM, financial, support-case and iHealth systems were not accessed, and that some knowledge-base files held configuration details for a small percentage of customers. CISA issued Emergency Directive 26-01 the same day, ordering federal agencies to inventory and patch F5 devices by 22 October.
Timeline at a glance
9 Aug 2025F5 learns a nation-state actor has persistent access (per its 8-K). (The Hacker News)Confirmed
15 Oct 2025F5 discloses theft of BIG-IP source code and undisclosed vulnerability details; ships patches. (F5 K000154696)Confirmed
15 Oct 2025CISA Emergency Directive 26-01: inventory F5 devices; patch priority products by 22 Oct. (CISA ED 26-01)Confirmed
Oct 2025Bloomberg reports China-linked actor and BRICKSTORM malware; F5 has not named a country. (The Hacker News)Reported
31 Oct 2025CISA deadline to update all other F5 devices. (CISA ED 26-01)Confirmed
Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
F5 incident timeline, in detail
Confirmed = acknowledged by F5, a regulator filing or a court. Reported = credible reporting F5 has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Aug – Oct 2025ConfirmedNation-state intrusion / vendor
Nation-state actor exfiltrates BIG-IP source code and undisclosed vulnerability information
What happened. F5’s disclosure (SEC 8-K and security advisory K000154696, 15 October 2025) says a highly sophisticated nation-state threat actor maintained long-term, persistent access to, and downloaded files from, certain F5 systems, including the BIG-IP product development environment and engineering knowledge-management platforms. F5 learned of it on 9 August 2025 and delayed public disclosure at the Department of Justice’s request.
Impact. Files included part of the BIG-IP source code and information about undisclosed BIG-IP vulnerabilities. F5 said it had no evidence of access to its CRM, financial, support-case-management or iHealth systems. Some exfiltrated knowledge-base files contained configuration or implementation details for a small percentage of customers, whom F5 said it would contact directly. F5 released BIG-IP, F5OS and BIG-IQ updates alongside the disclosure.
CISA issues Emergency Directive 26-01 for F5 devices
What happened. CISA said the theft gives the actor a technical advantage in finding and exploiting flaws in F5 devices and software, and ordered federal civilian agencies to inventory every BIG-IP hardware and software instance, check whether management interfaces are internet-facing, update F5OS, BIG-IP TMOS, BIG-IQ and BNK/CNF by 22 October 2025, update all other F5 devices by 31 October, and disconnect public-facing devices that are past end of support.
Impact. CISA also urged state, local and private-sector organisations using F5 products to take the same steps.
Attribution to a China-linked actor using BRICKSTORM malware
What happened. Bloomberg reported that the intrusion involved the BRICKSTORM backdoor, which Google’s threat-intelligence team attributes to the China-nexus cluster UNC5221, and that the attackers were present for at least 12 months. F5 and CISA described the actor only as nation-state affiliated.
Impact. Useful context for hunting, but it is press attribution rather than a statement from F5 or the US government.
How long were they inside? F5 said “long-term, persistent access” without a duration; Bloomberg reported at least 12 months.
Who was it? F5 and CISA say “nation-state”; China and UNC5221 come from press reporting, not an official attribution.
Customer data: F5 says only a small percentage of customers had configuration details in the stolen files and that core customer systems (CRM, support, iHealth) were untouched; the full list of affected customers has not been published.
The pattern across the record
The vendor is the target because its customers are
Source code plus unpublished bug details for an edge device is a roadmap into every network that runs it. That is why the government response was aimed at customers, not at F5.
Dwell time in the build environment
The access sat in product development and engineering knowledge systems, the places security vendors protect least like production and that matter most to their customers.
What it means for F5 customers — and what to do
If you run BIG-IP, F5OS, BIG-IQ or related products, treat this as a patch-and-harden event even if F5 did not contact you about configuration files.
1.Inventory every F5 device and version
Hardware, Virtual Edition and cloud instances included. You cannot patch what you have not found.
2.Take management interfaces off the internet
CISA’s directive treats an internet-reachable management interface as the first thing to fix. Put it behind a jump host or management network.
Yes. F5 disclosed on 15 October 2025 that a nation-state threat actor had long-term access to its systems and stole files including some BIG-IP source code and details of undisclosed vulnerabilities. F5 found the access on 9 August 2025.
What was stolen in the F5 breach?+
Part of the BIG-IP source code, information about vulnerabilities F5 had not yet published, and, for a small percentage of customers, configuration or implementation details held in an engineering knowledge platform. F5 said its CRM, financial, support-case and iHealth systems were not accessed.
What is CISA Emergency Directive 26-01?+
An order issued on 15 October 2025 requiring US federal civilian agencies to inventory F5 devices, update priority products by 22 October 2025 and all others by 31 October, remove internet-facing management interfaces and disconnect end-of-support devices. CISA urged other organisations to do the same.
Who hacked F5?+
F5 and CISA say a nation-state actor. Bloomberg reported a China-linked group using BRICKSTORM malware; F5 has not publicly confirmed that attribution.
Do I need to do anything if I use F5 BIG-IP?+
Yes: inventory your devices, take management interfaces off the internet, apply F5’s October 2025 and later updates, retire end-of-support devices, and rotate secrets if F5 told you your configuration was in the stolen files.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by F5. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout