Cybersecurity Giant Check Point Allegedly Breached, Hacker Sells Inside Access

At a glance

• Hacker claims: A hacker claimed to have breached Check Point, a leading cybersecurity firm.
• Access for sale: The hacker offered data and access tied to Check Point on an underground forum.
• Company’s response: Check Point said the claim referred to an old, limited incident that had already been handled.
• Implications: The episode raises questions about how security vendors protect their own systems.

A breach claim against a security vendor

A hacker claimed on a cybercrime forum to have breached Check Point, one of the best-known names in cybersecurity. Access was for sale. The claim spread quickly because it involved a company whose business is stopping exactly this kind of attack.

What the hacker claimed

On March 30, 2025, a hacker using the name “CoreInjection” posted on BreachForums, claiming to have breached Check Point’s network. The hacker offered data and access to buyers and posted screenshots as supposed proof. Security companies are attractive targets because access to them can open doors to their customers.

How Check Point responded

Check Point quickly disputed the claims. The company said the post described an old incident from December 2024 involving compromised credentials for a portal account with limited access. It said the incident affected three organizations’ tenants, was handled at the time and did not touch customer systems, production systems or its security architecture.

Trust and Reputation on the Line

A breach at a cybersecurity firm is a serious problem for that company and for the industry’s reputation. Customers trust these firms with their defenses. Check Point’s credibility depends on handling claims like this quickly and openly.

Why attackers target security companies

Criminals increasingly go after security firms themselves. Why? These companies hold valuable customer information and run security services for many clients worldwide, so a real breach at one of them could hurt client relationships and trust across the whole industry for years.

A lesson for every organization

Attackers keep developing new ways around security controls. Even industry leaders need to review their defenses regularly, starting with the accounts that have access to partner and customer portals.

What to take from it

Whatever the full truth, the episode shows that security vendors are targets too. Companies should check which vendor accounts can reach their systems and require multi-factor authentication on every one of them. Vendors, in turn, should disclose incidents early, before someone else tells the story for them.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.