General Electric Co. has allegedly been hacked, and the hacker is offering stolen data, including Defense Advanced Research Projects Agency documents for sale on a hacking forum, raising national security concerns.

The hacker behind the alleged hack goes by the name of “IntelBroker” and was offering the stolen data for sale on the BreachForums hacking forum, which is not a dark web site but a regular internet forum easily found in Google. According to the listing, the hacker is selling the stolen data, which includes SSH and SVN access, DAPRA-related military information, SQL files and documents. The hacker does provide screenshots of the stolen information as proof of the hack.

IntelBroker was previously in the news in September following a data breach at DC Health Link, the District of Columbia’s health insurance exchange. The data stolen in that hack included Social Security numbers, dates of birth, email addresses and home addresses.

Officially, GE has neither confirmed nor denied that they were hacked. A spokesperson told Bleeping Computer that the company is “aware of claims made by a bad actor regarding GE data and are investigating these claims. We will take appropriate measures to help protect the integrity of our systems.”

Given GE’s role in the defense industry and the inclusion of documents from DAPRA, the breach may have serious U.S. national security implications.

“Aside from the theft of classified information, I am very concerned that GE’s environment is being used to conduct island hopping into Federal agencies,” Tom Kellermann, senior vice president of cyber strategy at application security software platform provider Contrast Security Inc., told SiliconANGLE. “IntelBroker is notorious for selling access to compromised systems. I would assume the Chinese and Russians are already in.”

Darren Williams, founder and chief executive of anti-data exfiltration and ransomware prevention company BlackFog Inc., said  IntelBroker has already been responsible for a handful of high-profile attacks.

“This attack will not only have a negative impact on the company itself but could have substantial implications for the current sensitive military projects the company tends to work on, which could in turn threaten U.S. national security,” Willams explained. “Data related to the government is highly prized, so companies in collaboration with government agencies need to be reminded that they also have a responsibility to protect that data from exfiltration and malicious use.”

Photo: Chuck Miller/Flickr