Electronics giant Avnet reports data breach affecting EMEA operations
Learn More
Electronics distributor Avnet is reporting a data breach after a breach of externally hosted cloud storage supporting an internal sales tool used in its Europe, Middle East, and Africa (EMEA) region.
The Arizona-based company operates distribution and design/engineering centers in 125 countries.
The incident was detected on September 26, 2024. According to threat actors who contacted BleepingComputer, they stole approximately 1.3 terabytes of compressed data from Avnet's systems, which should be between 7 and 12 terabytes of raw data. The stolen information includes
- Personally identifiable information (PII)
- Operational details for EMEA and other regions
The nature of the attack and number of affected individuals is not disclosed.
Avnet spokesperson acknowledged the breach but is claiming that "most of the data is not easily readable without access to Avnet's proprietary sales tool, which remains secure and was not impacted by this event." This claim is contradicted by data samples published by the threat actors on a dark web leak site which clearly show sensitive information in plaintext format, including personally identifiable information. Avnet confirmed the existence of plaintext data but characterized it as non-sensitive information under GDPR definitions. The company did not verify the authenticity of the leaked data samples.
According to the threat actors, Avnet breach the intrusion on September 26 and immediately began rotating all secrets throughout its Azure and Databricks environments without publicly disclosing the incident. The company completed credential rotation that same night and reported no further signs of unauthorized activity following the remediation efforts.
Avnet has emphasized that the incident was limited to a single system in the EMEA region and did not disrupt the company's global operations. The electronics distributor has informed relevant authorities about the breach and stated that impacted customers and suppliers will be contacted directly.
