Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach and Cyber Attack.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with modifying how they safeguard and keep access keys, and communication strategy with informed that it's not necessary to change passwords, change encryption keys, or modify your network setup, and remediation measures with strengthening security practices, remediation measures with mitigating future risks, and communication strategy with issued recommendations to customers, and enhanced monitoring with regular security monitoring, and containment measures with isolating management interfaces, containment measures with monitoring file operations, containment measures with analyzing soap traffic for suspicious activities, and containment measures with upgrade firmware to version 3.2.1.0 or later, and remediation measures with remove hardcoded credential branch from authenticate() routine and enforce robust credential management policies, and network segmentation with segment management traffic to trusted administrative vlans, and enhanced monitoring with audit access logs for suspicious web interface logins, and incident response plan activated with yes (disclosed in 2024 after detection in december 2023), and communication strategy with public disclosure in 2024, and third party assistance with check point research, and remediation measures with apply patches and implement compensating controls..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Default Passwords, Outdated Juniper Networks Junos OS routers, Outdated Juniper Networks Junos OS MX routers, Hardcoded credentials embedded within the device’s web interface, compromised laptop, Compromised Microsoft 365 Account and ExecuteCommand REST API endpoint (HPE OneView id-pools functionality).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Network Telemetry Information, Location-Specific Information, , Customer Data, Employee Data, , Personal Identifiable Information (Pii), Military Occupational Data, , Personally Identifiable Information (Pii), Financial Data, Internal Business Communications and .

Incident Response Plan: The company's incident response plan is described as Yes (disclosed in 2024 after detection in December 2023).

Third-Party Assistance: The company involves third-party assistance in incident response through Check Point Research.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Modifying how they safeguard and keep access keys, , Strengthening security practices, Mitigating future risks, , Remove hardcoded credential branch from authenticate() routine and enforce robust credential management policies, Apply patches and implement compensating controls.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by isolating management interfaces, monitoring file operations, analyzing soap traffic for suspicious activities, and upgrade firmware to version 3.2.1.0 or later.

Key Lessons Learned: The key lessons learned from past incidents are Importance of strong password policies,Regular security monitoringEnd-to-end email encryption is critical to limit exposure even if accounts are compromised.,Dwell times for advanced threats can span months or years, emphasizing the need for proactive detection.,Unencrypted email archives pose a long-term risk, as they contain historical sensitive data.,Individuals and enterprises must prioritize encryption, multi-factor authentication (MFA), and data hygiene (e.g., deleting old documents).,Email security must evolve beyond basic protections (e.g., spam filters, passwords) to address targeted attacks.Urgency of applying patches and implementing compensating controls to mitigate exposure.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Apply patches for CVE-2025-37164 and implement compensating controls for HPE OneView.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Mandiant Research, and Source: HPE Aruba Networking’s Bug Bounty program, and Source: Bleeping Computer, and Source: MakeUseOf (MUO) - Afam Onyimadu, and Source: Check Point Research, and Source: CISA Known Exploited Vulnerabilities (KEV) catalogDate Accessed: 2026-01-07.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Informed That It'S Not Necessary To Change Passwords, Change Encryption Keys, Or Modify Your Network Setup, Issued Recommendations To Customers and Public disclosure in 2024.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Issued Recommendations To Customers and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Regular Security Monitoring, , Audit access logs for suspicious web interface logins, Check Point Research.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Strengthening Security Practices, Regular Security Monitoring, , Upgrade firmware to remove hardcoded credential branch and enforce robust credential management policies, Patch management and compensating controls.

Last Attacking Group: The attacking group in the last incident were an Mirai Botnet, UNC3886, UNC3886, Midnight Blizzard (APT29) and RondoDox botnet.

Most Recent Incident Detected: The most recent incident detected was on 2024-12-11.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-12-16.

Most Significant Data Compromised: The most significant data compromised in an incident were MAC addresses, IP addresses, device operating system type, hostname, usernames, Access Point (AP) name, proximity, duration of time connected to the AP, , Customer Data, Employee Data, , names, Social Security numbers, , Social Security Numbers, Driver’s Licenses, Payment Card Details, Internal Communications, Financial Reports, Identity Documents and .

Most Significant System Affected: The most significant system affected in an incident was Network analytics datasetContact tracing dataset and Session Smart Router (SSR) products and and Juniper Networks Junos OS routers and Juniper Networks Junos OS MX routers and and Career Waypoints (C-WAY) database and Microsoft 365 Email Environment and .

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Check Point Research.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were isolating management interfacesmonitoring file operationsanalyzing SOAP traffic for suspicious activities and Upgrade firmware to version 3.2.1.0 or later.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security Numbers, proximity, Employee Data, Financial Reports, device operating system type, duration of time connected to the AP, hostname, names, Social Security numbers, usernames, IP addresses, MAC addresses, Payment Card Details, Customer Data, Internal Communications, Identity Documents, Driver’s Licenses and Access Point (AP) name.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 134.4K.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Email security must evolve beyond basic protections (e.g., spam filters, passwords) to address targeted attacks., Urgency of applying patches and implementing compensating controls to mitigate exposure.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Strengthening security practices, Monitor for unusual account activity with advanced threat detection tools., Assume breach mentality: design security controls to limit data exposure even if perimeter defenses fail., Mitigating future risks, Implement end-to-end encryption for all email communications., Regularly audit and clean up old or unnecessary emails and attachments., Enforce multi-factor authentication (MFA) across all accounts, especially email., Hold email providers accountable for baseline encryption standards. and Apply patches for CVE-2025-37164 and implement compensating controls for HPE OneView.

Most Recent Source: The most recent source of information about an incident are Bleeping Computer, HPE Aruba Networking’s Bug Bounty program, Check Point Research, Mandiant Research, CISA Known Exploited Vulnerabilities (KEV) catalog and MakeUseOf (MUO) - Afam Onyimadu.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Disclosed (2024); no further updates on root cause or forensic details.

Most Recent Customer Advisory: The most recent customer advisory issued was an Issued recommendations to customers.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Default Passwords, Hardcoded credentials embedded within the device’s web interface, compromised laptop, Outdated Juniper Networks Junos OS routers, ExecuteCommand REST API endpoint (HPE OneView id-pools functionality), Outdated Juniper Networks Junos OS MX routers and Compromised Microsoft 365 Account.

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Unknown (breach undetected for ~7 months).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Weak Password Policies, Outdated Junos OS routers, Outdated Juniper Networks Junos OS MX routers, Hardcoded login credentials embedded within the devices’ software, Lack of end-to-end encryption for email content.Insufficient detection mechanisms to identify the breach for ~7 months.Targeted compromise of a high-privilege Microsoft 365 account., Missing authentication and authorization checks in HPE OneView's ExecuteCommand REST API endpoint.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Strengthening security practicesRegular security monitoring, Upgrade firmware to remove hardcoded credential branch and enforce robust credential management policies, Patch management and compensating controls.