Apple supplier locks down systems after alleged Apple files appear on dark web
An Apple supplier at the heart of the company's push to move iPhone production out of China has locked down its internal systems after a ransomware group leaked thousands of confidential files allegedly linked to Apple, Tesla, TSMC and Qualcomm. The breach has triggered a forensic investigation and prompted Apple's security team to step in, according to sources.
Customers exit an Apple Store. Photo by Cheng Xin/Getty Images.
An Apple supplier at the heart of the company's push to move iPhone production out of China has locked down its internal systems after a ransomware group leaked thousands of confidential files allegedly linked to Apple, Tesla, TSMC and Qualcomm. The breach has triggered a forensic investigation and prompted Apple's security team to step in, according to sources. Tata Electronics, a key Indian supplier to Apple, has restricted internal access to sensitive systems as it investigates a leak of thousands of secret client files on the dark web, a Tata source and two industry officials said.
- An Apple supplier has tightened security after hackers leaked more than 200,000 files allegedly containing confidential customer documents.
- The leaked data reportedly includes files linked to Apple, Tesla, TSMC and Qualcomm, although Reuters could not verify their authenticity.
- Tata Electronics has restricted employee access to sensitive systems, hired a forensic cybersecurity firm, and notified Indian authorities and affected clients.
- Apple's security team is reportedly working closely with Tata on both immediate containment and long-term security measures.
- The incident comes as Tata becomes one of Apple's most important manufacturing partners outside China, raising the stakes for the company's supply chain.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Tata has also hired a global consultant to conduct a forensic audit and has reported the incident to the Indian government and its clients, said the Tata source, declining to be named given the sensitivity of the matter.
Reuters reported this week that ransomware group World Leaks posted more than 200,000 files to the dark web, including purported component design papers from Apple and Tesla, both of which are Tata clients. Reuters could not verify the authenticity of the data.
Tata has said it had identified a "cybersecurity incident" and there was no impact on operations, without providing additional details.
Reuters found that the leak also contains at least 16 files and folders of purported documents from Taiwan Semiconductor Manufacturing Co (TSMC) and 23 from Qualcomm, both of which make parts used in iPhones.
After it detected the breach, Tata Electronics tightened internal security protocols at all its facilities and offices to restrict remote access to sensitive internal tools, such as those used to place purchase orders, only to select employees, said the Tata source and two people briefed on the matter.
Earlier, access to such internal tools was more liberal, the Tata source said, adding that while work-from-home is still allowed, "only select people have remote access" to such tools. The changes apply to Tata Electronics broadly and are not restricted to a few factories.
"Tata Electronics has hardened access to its sensitive internal systems," the Tata source said. "The investigation is ongoing."
Tata Electronics, Apple, TSMC and Qualcomm did not respond to Reuters queries. All sources cited in this article declined to be named given the sensitivity of the matter.
The Indian Computer Emergency Response Team, a unit under India's IT ministry that received the Tata incident report, also did not respond.
Cyberattack hits key Apple supply chain partner
One of the industry officials added that tighter controls included making Tata's official network access more strictly regulated when employees access it from outside the company's facilities.
Apple's security team is working closely with Tata on near- and long-term measures following the incident, the person added.
Reuters is first to report details on the internal process changes and the forensic investigation at Tata Electronics.
With former Intel and Applied Materials executive Randhir Thakur as its CEO, Tata Electronics is part of the salt-to-aviation Tata conglomerate. It was set up in 2020. Its businesses extend to semiconductors, but Tata is one of Apple's most important Indian suppliers and it is central to the American firm's effort to make more iPhones outside China.
The breach is also a setback for Apple's supply chain. Tata also faces scrutiny over the alleged contamination of farmlands near one of its iPhone parts plants in India. Separately, Tata was hit by a cyberattack at its British Jaguar Land Rover unit last year, which resulted in a six-week output halt.
Dark web leak allegedly contains Apple, TSMC and Qualcomm documents
World Leaks, which has previously claimed responsibility for a Nike break-in, said on its dark net website that it has published more than 204,341 files containing Tata Electronics data totalling over 630.4 gigabytes.
Reuters reported previously that the searchable database shows several files from Apple and Tesla, but further reporting showed that purported documents from more companies were leaked.
One 2022 document, marked "TSMC Secret," contained purported "product reliability test" details of a TSMC component with photographs. An "Apple Silicon Engineering Group" document from 2023 maps Apple parts numbers to TSMC's numbers, with details of Apple employees in the document's revision history.
A purported Qualcomm document from 2021 shows mechanical information on the functioning of a power management integrated circuit with drawings, watermarked "Confidential - May Contain Trade Secrets."
The World Leaks website is only accessible on the dark web, meaning it is beyond the reach of search engines. Reuters was not able to reach World Leaks for comment.
India is on track to make 26% of the world's iPhones in 2026, up from 6% four years ago, according to Counterpoint, a research firm.
Unlock more exclusive Cybernews content on YouTube.