Was Huawei hacked? The reported NSA intrusion (2014) and an unverified 2025 source-code claim
Huawei sells network gear, cloud services and security products, including its HiSec security management and SIEM-style analytics. Two stories drive searches about a Huawei breach: Snowden documents reporting that the NSA got inside its headquarters network, and a 2025 dark-web listing offering its source code. Neither has been confirmed by Huawei. This page separates what was reported, by whom, from what is only claimed.
Short answer
Was Huawei hacked?
Huawei has not confirmed any breach of its own systems. In March 2014 Der Spiegel and The New York Times, citing documents leaked by Edward Snowden, reported that the US National Security Agency had infiltrated Huawei’s headquarters network in Shenzhen in an operation the Times said was code-named “Shotgiant”. Der Spiegel reported that the NSA copied a list of 1,400 customers and, per an NSA presentation, reached the email archive and source code of individual products. The NSA declined to comment on specific operations; Huawei said that if the reports were true, it condemned the intrusion.
In October 2025 a threat actor offered what it said was Huawei source code and internal development tools on a dark-web forum. No data samples were verified and Huawei made no public statement, so this is an unverified claim, not a confirmed breach.
Timeline at a glance
From Jan 2009NSA reads a large share of Huawei staff email, incl. the CEO’s, per Snowden documents (reported 2014). (Der Spiegel)Reported
22 Mar 2014Der Spiegel and the NYT report the NSA infiltrated Huawei’s Shenzhen network (“Shotgiant”). (PCWorld (NYT, Spiegel))Reported
24 Mar 2014Huawei: “If the actions in the report are true, Huawei condemns such activities.” (TechCentral (Reuters))Reported
~3 Oct 2025A threat actor offers alleged Huawei source code and internal tools on a dark-web forum. (GBHackers)Unverified claim
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Huawei incident timeline, in detail
Confirmed = acknowledged by Huawei, a regulator filing or a court. Reported = credible reporting Huawei has not fully confirmed. Unverified claim = an attacker or leak-site claim.
2009 – 2014 (reported)ReportedNation-state espionage (reported from leaked documents)
NSA “Shotgiant” operation against Huawei headquarters
What happened. On 22 March 2014 Der Spiegel and The New York Times published reports based on documents leaked by Edward Snowden. Der Spiegel wrote that a special NSA unit infiltrated Huawei’s network and copied a list of 1,400 customers and internal engineer training documents, and that a top-secret NSA presentation said it accessed the email archive and the source code of individual Huawei products. It said that because Huawei routed staff email through a central office in Shenzhen, the NSA could read a large share of it from January 2009, including messages from CEO Ren Zhengfei and chairwoman Sun Yafang. PCWorld, summarising the Times, said the operation was code-named “Shotgiant” and aimed to probe suspected Huawei links to China’s military and to exploit Huawei equipment.
Impact. The NSA declined to comment on specific foreign intelligence activities. Huawei’s global cyber security officer John Suffolk told Reuters: “If the actions in the report are true, Huawei condemns such activities that invaded and infiltrated into our internal corporate network and monitored our communications.” Huawei has not confirmed that the intrusion happened or what was taken, and no customer notification is publicly known.
Threat actor claims to sell Huawei source code and internal tools
What happened. Around 3 October 2025 a threat actor posted an offer on a dark-web forum for what it described as Huawei source code and internal development tools, according to GBHackers and SC Media. GBHackers reported that researchers were still checking whether the material was genuine and that threat actors sometimes fabricate or exaggerate such claims.
Impact. Huawei has not issued a statement about the claim, and no verified samples have been published. Huawei was named by a threat actor; Huawei has not confirmed a breach.
Start date of the NSA operation: Der Spiegel dates the email access from January 2009; PCWorld’s summary of the Times says covert operations against Huawei date back to 2007. Neither has been confirmed by the NSA or Huawei.
Huawei’s response varied: Suffolk condemned the activity “if” true, while US executive William Plummer told the Times that such spying, if real, would show the company’s independence. Neither confirmed nor denied an intrusion.
The 2025 claim: secondary reports differ on details of the listing (price and whether it was later marked sold). We quote none of them because no primary source or sample was verified.
The pattern across the record
Reported is not confirmed
The 2014 story comes from leaked intelligence documents published by reputable newspapers, not from Huawei or a regulator. It is well sourced journalism about an intrusion, but the company has never confirmed scope or impact.
Vendors are intelligence targets
The documents say the aim was to learn how to exploit Huawei products that targets used. Any network or security vendor, of any nationality, is a target for the same reason: access to its code and customer list is access to its customers.
What it means for Huawei customers — and what to do
Nothing here requires an emergency response, but if you use Huawei network or security products, plan as if their source code and customer list may be in other hands.
1.Assume the code is known
Keep Huawei devices patched and take management interfaces off the internet, so an attacker who knows the code still cannot reach it.
Huawei has not confirmed any breach. In 2014 Der Spiegel and The New York Times reported, from Snowden documents, that the NSA infiltrated Huawei’s headquarters network. In 2025 a threat actor claimed to sell Huawei source code; that claim is unverified.
What did the NSA reportedly take from Huawei?+
Per Der Spiegel, a list of 1,400 customers, engineer training documents, access to the email archive including the CEO’s email from January 2009, and source code of individual products. The NSA declined to comment and Huawei has not confirmed it.
What was Operation Shotgiant?+
The code name The New York Times reported for the NSA operation against Huawei, aimed at probing suspected links to China’s military and at learning to exploit Huawei equipment.
Was Huawei source code leaked in 2025?+
A threat actor claimed in October 2025 to be selling Huawei source code and internal tools on a dark-web forum. No samples were verified and Huawei made no statement, so it remains an unverified claim.
Should Huawei customers do anything?+
No emergency action follows from these reports. Keep Huawei products patched, keep management interfaces off the internet, rotate secrets stored on devices and include the vendor in your third-party risk reviews.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Huawei. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →