Security
IBM and AT&T accused in an unsealed whistleblower suit of hiding APT10 intrusions from the US government; IBM says the DOJ declined to intervene
A former IBM threat-intelligence chief alleges IBM and AT&T hid APT10 intrusions to keep federal contracts. IBM disputes it; no court has ruled.
This is not a new development: the suit was unsealed in early June 2026, and coverage dates from June 4 to 5. William Barlow, IBM's former head of threat intelligence, alleges in a False Claims Act complaint filed under seal in 2020 that IBM and AT&T failed to disclose intrusions, including by the China-linked group APT10, while assuring federal buyers their systems were secure. IBM disputes this and points out that the Department of Justice declined to intervene. The allegations are untested: no court has ruled on them, and we found no newer ruling as of November 7.
The essentials
- The accuser: William Barlow, who led IBM threat intelligence from 2017 to 2019, per GovInfoSecurity. The case is pending in Manhattan federal court.
- The allegations: Five Eyes agencies warned IBM in 2017 that APT10 had penetrated its cloud, and an internal review allegedly counted more than 56,000 possible APT10 breaches between 2013 and 2016. Some could not be investigated because logs were missing.
- The response: IBM's spokesperson did not address the specifics. The company said the complaint is six years old, the DOJ declined to intervene, and it is confident it followed the letter of the law. AT&T did not respond.
- The caveat: a decision not to intervene does not indicate whether a complaint has merit, as Barlow's attorney noted in the Bloomberg-based coverage.
What exactly is alleged about the contracts?
The complaint says IBM downplayed or concealed incidents before signing government agreements that required it to certify it had no significant unresolved cybersecurity issues, and that it kept claiming its network was secure when bidding. It also alleges executives told Barlow to tone down reports. These are claims in a filing, not findings.
What does 56,000 mean?
Outlets describe it as potential indicators or possible breaches attributed to APT10 in an internal investigation, not confirmed intrusions. The complaint itself, as relayed, says neither company knew what data was taken or whether it left the network. The 2018 DOJ indictment of two APT10 members is a separate matter.
What is not established
- Whether the intrusions occurred as described: not established; no court ruling.
- Why the DOJ declined to intervene: court records do not explain it, per Bloomberg-based reports.
- What data, if any, was exfiltrated from IBM or AT&T systems: the complaint says this is unknown.
- Any development since June: we found none as of November 7, 2026.
Summary table
| Point | What is stated as of November 7, 2026 | Source |
|---|---|---|
| Case | False Claims Act suit filed under seal in 2020, unsealed June 2026 | GovInfoSecurity |
| Plaintiff | William Barlow, ex-IBM threat intelligence lead (2017 to 2019) | GovInfoSecurity |
| Core claim | IBM and AT&T hid intrusions, including APT10, from the government | Security Boulevard |
| IBM response | Complaint is six years old; DOJ declined; actions followed the law | Claims Journal |
| Status | Pending in New York federal court; allegations untested | GovInfoSecurity |
FAQ
Did the court find IBM guilty?
No. The suit is pending and the allegations have not been tested.
Does the DOJ declining to intervene clear IBM?
No. Such a decision does not indicate whether a complaint has merit.
Is this new in November?
No. It was unsealed and reported in early June 2026; we found no later ruling.
Method and limits
Sources checked on November 7, 2026. We read the GovInfoSecurity report; the Security Boulevard and Claims Journal items were read as search excerpts, and Bloomberg's original report was not read directly. All claims about IBM and AT&T are allegations. This is not legal or security advice.
Sources
- GovInfoSecurity: Ex-Threat Intel Exec Accuses IBM and AT&T of Hiding Hacks (verified 2026-11-07)
- Security Boulevard: IBM and AT&T Accused of Covering Up Foreign Hacks (verified 2026-11-07)
- Claims Journal: IBM, AT&T Accused by Whistleblower of Covering Up Foreign Hacks (verified 2026-11-07)
Spotted an error in this article? Report it · Our corrections policy
