Hacker Steals 900 GB of Data from Cellebrite, Exposing Customer Information and Technical Details

A hacker successfully breaches one of Cellebrite’s servers and steals approximately 900 GB of sensitive data, which is then provided to Motherboard. The stolen cache includes customer usernames and passwords for accessing Cellebrite’s my.cellebrite domain used by customers to download software updates, extensive technical documentation about Cellebrite’s products, and what appears to be evidence files from seized mobile phones along with logs from Cellebrite devices in use. The breach exposes the scope of Cellebrite’s global law enforcement customer base and raises serious security concerns about a company entrusted with highly sensitive investigative data. The hacker tells reporters the breach was motivated by concerns about Western governments’ surveillance capabilities and represents part of a growing trend of hacktivists targeting companies that specialize in surveillance technologies. On January 24, Cellebrite confirms the breach but downplays its significance, claiming it involved only “basic user contact details and hashed user passwords” from a remote server, though the stolen data appears far more extensive. The company advises customers to change passwords and states it is cooperating with authorities. This breach is the first of multiple security incidents that will expose Cellebrite’s customer lists and raise questions about the security practices of companies selling powerful surveillance tools to governments worldwide.