Acer Inc.

Summary

Acer confirmed unauthorized access to a document server for repair technicians after a hacker advertised the sale of approximately 160GB of purportedly stolen confidential data, including product documentation, backend infrastructure details, digital product keys, BIOS information, and staff materials. The company indicated no evidence of consumer data exposure on the affected server. The attacker, operating on a cybercrime forum with established credibility, claimed the compromise occurred in mid-February. This incident follows a prior breach involving compromised servers in regional offices.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Acer Inc. confirmed a cybersecurity breach in early March 2023 after a hacker advertised approximately 160 GB of stolen company data for sale on a cybercrime forum. The unauthorized access targeted a document server dedicated to servicing repair technicians, with the intrusion occurring around mid-February 2023 according to the threat actor’s claims. The hacker, described as having an established reputation on the forum, offered over 2,800 files containing confidential product documentation, technical slides, staff training materials, binary files, backend infrastructure details, replacement digital product keys, BIOS-related data, and disk images. Acer’s internal investigation detected the breach but stated no evidence indicated consumer data resided on the compromised server at the time of the incident. The company did not disclose the intrusion until after the attacker publicly listed the stolen data for sale in exchange for Monero cryptocurrency, though the specific ransom amount remained undisclosed.

This incident marks at least the second major confirmed breach for Acer since October 2021, when attackers compromised servers in Taiwan and India—a breach involving over 60 GB of exfiltrated corporate data. The 2023 attack focused exclusively on technical repair and operational assets rather than consumer-facing systems, though the stolen materials posed risks to intellectual property, product security, and internal operational protocols. Acer restricted its public commentary to acknowledging the server breach and emphasizing the ongoing investigation, without detailing remediation steps, forensic findings, or potential impacts on product integrity. No consumer data exposure notifications were issued, consistent with the company’s assertion regarding the server’s restricted function. The hacker’s advertisement highlighted the theft of sensitive technical resources critical to device repairs and maintenance workflows, introducing potential supply-chain and counterfeiting risks derived from the exposed digital product keys and BIOS information.

Sources

Sources available to members: 2 sources.