Chinese Hackers Suspected In Long-Term Nortel Breach

Using seven passwords stolen from top Nortel executives, including the chief executive, the hackers—who appeared to be working in China—penetrated Nortel’s computers at least as far back as 2000 and over the years downloaded technical papers, research-and-development reports, business plans, employee emails and other documents, according to Brian Shields, a former 19-year Nortel veteran who led an internal investigation…

Mr. Shields and several former colleagues said the company didn’t fix the hacking problem before starting to sell its assets, and didn’t disclose the hacking to prospective buyers. Nortel assets have been purchased by Avaya Inc., Ciena Corp., Telefon AB L.M. Ericsson and Genband.

It is possible for companies to inherit spyware or hacker infiltrations via acquisitions, said Sean McGurk, who until recently ran the U.S. government’s cybersecurity intelligence center. “When you’re buying those files or that intellectual property, you’re also buying that ‘rootkit,'” he said, using a term that refers to embedded spy software.

Nortel’s experience exposes the uncertainties in reporting requirements for company officials who discover that their networks are infiltrated. Companies aren’t obligated to disclose a breach to another company as part of an acquisition deal, said Jacob Olcott of Good Harbor Consulting, a firm that advises companies on national-security issues. It is up to the acquiring company to ask, he said.

Since Nortel’s stock traded publicly in the U.S., it was required by the Securities and Exchange Commission to disclose “material” risks and events to investors. Many companies are just now becoming aware that cyber attacks must be reported if considered material, said Mr. Olcott, a former Capitol Hill aide who led a committee investigation into public disclosure of incidents like these….

I don’t know if the original WSJ story can be accessed without a subscription, so I’ve copied the entire thing and forwarded it to my old colleagues for whom this will be of great interest.

My old career used to be mainly with Nortel products, Nortel’s fall led to my layoff with little chance of finding another gig. No one is buying or installing new Nortel products anymore.  The big new market in the world was China, but I guess they didn’t need to buy Nortel’s technology either. Now we know why.

This doesn’t surprise me, nor will it surprise my friends. Nortel was doing some pretty stupid things at the end. If I had to sum up; they concentrated on issues and markets that were beyond them, and ignored the basics of their business, in particular their customers and partners.

Hell of a business they threw away.