Cybersecurity agency F5 Networks says government-backed hackers had “long-term, persistent entry” to its community, which allowed them to steal the corporate’s supply code and buyer data.

In a submitting with the U.S. Securities and Change Fee on Wednesday, F5 mentioned it now “believes its containment actions have been profitable,” after first discovering the hackers in its community on August 9.

The Seattle, Washington-based firm, which focuses on offering software safety and cybersecurity defenses for giant firms and governments, mentioned the hackers had entry to its BIG-IP product growth atmosphere and its information administration programs, which included supply code and publicly undisclosed safety vulnerabilities.

F5 mentioned it wasn’t conscious of any modifications to its software program whereas in growth, nor was it conscious of any exploitation of the vulnerabilities. The corporate revealed a number of updates on Wednesday for its BIG-IP platform to repair the undisclosed safety flaws and urged clients to patch them.

The corporate additionally mentioned the hackers downloaded configurations and implementation details about a few of its clients’ programs, information that would assist hackers discover and exploit potential design weaknesses, and probably hack into these clients’ programs.

F5 mentioned within the discover that the U.S. Division of Justice allowed the corporate to delay its public disclosure. An F5 spokesperson wouldn’t say for what purpose the delay was allowed, however the DOJ can permit firms to carry off on notifying the general public if there’s a “substantial danger to nationwide safety or public security.”

F5 has over 1,000 company clients and serves greater than 85% of the Fortune 500, the biggest public firms by income, together with banks, tech firms, and important infrastructure firms.

The U.Okay.’s Nationwide Cyber Safety Centre warned on Wednesday, following F5’s disclosure, that hackers might “allow a menace actor to take advantage of F5 gadgets and software program.”

CISA mentioned in an e mail on Wednesday that it has ordered civilian federal companies underneath an emergency directive to patch their programs by October 22, citing the safety dangers.

The corporate didn’t attribute the assaults to a specific authorities or nation-state-affiliated hacking group, and F5 spokesperson Dan Sorensen declined to reply TechCrunch’s questions past the firm’s revealed assertion, together with what number of clients are affected and if it was recognized how the hackers broke in to start with. 

F5 is the most recent tech firm in recent times to have been hacked by authorities hackers, together with Microsoft — by China, and Russia, not less than twice; cloud and enterprise expertise agency Hewlett Packard Enterprise, and a number of different firms as a part of the broader Russian cyberattack on the software program maker SolarWinds.