INCIDENT REPORT · CP-2025-020

F5 nation-state breach and CISA Emergency Directive 26-01

L3 · ELEVATEDCONFIRMED

F5 disclosed that a 'highly sophisticated nation-state threat actor' had long-term access to its systems and stole portions of BIG-IP source code and information on undisclosed vulnerabilities; CISA issued Emergency Directive 26-01 the same day.

Incident ID: CP-2025-020
Disclosure date: 15 OCT 2025
Detection date: 09 AUG 2025
Affected countries: United States
Plotted location: Seattle, Washington, United States (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Theft of source code for widely deployed edge devices prompting a federal emergency directive.
Attack type: Espionage
Nature: Malicious activity
Attack vector: Long-term persistent access to F5's BIG-IP product development environment and engineering knowledge platforms
Sectors: Technology, Government
Critical infrastructure: Yes
Organizations affected: F5, Inc., U.S. federal civilian agencies (via ED 26-01 obligations)
Operational consequences: CISA ordered federal agencies to inventory and patch F5 devices and disconnect unsupported ones, citing an imminent threat to networks using BIG-IP. F5 released security updates; no exploitation of the stolen information had been confirmed at disclosure.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by F5 to an unnamed nation-state threat actor

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

F5 nation-state breach and CISA Emergency Directive 26-01

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2025-020

Disclosure date

15 OCT 2025

Detection date

09 AUG 2025

Affected countries

United States

Plotted location

Seattle, Washington, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Theft of source code for widely deployed edge devices prompting a federal emergency directive.

Attack type

Espionage

Nature

Malicious activity

Attack vector

Long-term persistent access to F5's BIG-IP product development environment and engineering knowledge platforms

Sectors

Technology, Government

Critical infrastructure

Yes

Organizations affected

F5, Inc., U.S. federal civilian agencies (via ED 26-01 obligations)

Operational consequences

CISA ordered federal agencies to inventory and patch F5 devices and disconnect unsupported ones, citing an imminent threat to networks using BIG-IP. F5 released security updates; no exploitation of the stolen information had been confirmed at disclosure.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by F5 to an unnamed nation-state threat actor