Tata Consultancy Services

Summary

Tata Consultancy Services was among multiple technology firms compromised in a sustained cyber espionage campaign attributed to Chinese state-linked actors, specifically APT10. The attackers infiltrated cloud service providers to access client networks, exfiltrating sensitive corporate and government data to advance Chinese economic interests. The incident exposed systemic vulnerabilities in cloud computing ecosystems and highlighted challenges in coordinated defense, as service providers reportedly withheld breach details from affected clients due to liability and reputational concerns. Despite security countermeasures and international agreements prohibiting economic espionage, the perpetrators maintained persistent access, underscoring difficulties in detecting and mitigating sophisticated state-sponsored intrusions targeting supply chain intermediaries.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Between 2014 and 2017, Tata Consultancy Services (TCS) was among eight major technology service providers compromised in a sustained cyber espionage campaign known as 'Cloud Hopper.' Suspected Chinese state-sponsored hackers, later identified by U.S. prosecutors as Advanced Persistent Threat 10 (APT10), infiltrated the systems of multiple IT outsourcing firms, including TCS, to gain access to client networks. The attackers exploited vulnerabilities in cloud computing services, using compromised provider infrastructure as launchpads to breach customer environments. This method allowed APT10 to steal sensitive corporate and government data from multiple organizations across various sectors over several years. Security researchers and Western government agencies attributed the campaign to operatives working on behalf of China's Ministry of State Security, with evidence suggesting the stolen intellectual property was used to advance Chinese economic interests. The attacks persisted despite a 2015 bilateral agreement between the U.S. and China prohibiting state-sponsored economic espionage.

The Cloud Hopper campaign exposed systemic security challenges in cloud service models, where third-party IT providers managed critical infrastructure for numerous clients. TCS and other affected providers initially struggled to contain the breaches, with some attacks recurring even after initial mitigation efforts. Internal documents revealed service providers often withheld breach details from clients due to liability concerns and reputational risks, hampering coordinated response efforts. While the full impact on TCS specifically remains undisclosed, Reuters investigations confirmed the company experienced unauthorized network access during this period. TCS declined public comment when questioned about the incidents, mirroring the stance of several other compromised providers. The campaign's duration and scale highlighted deficiencies in information sharing between service providers, clients, and government agencies, with many victim organizations reportedly remaining unaware of their exposure years after the initial compromises. U.S. and UK intelligence agencies later issued joint advisories detailing APT10's cloud service targeting tactics.

Sources

Sources available to members: 1 source.