mercurynews.com
By Ethan Baron |

‘Top Secret’ files among those allegedly misappropriated by software engineer losing job at Santa Clara chip giant Intel

At first the software engineer did not succeed in making off with a trove of Santa Clara computer chip giant Intel’s trade secrets, but then he tried again.

Jinfeng Luo, at Intel since 2014, had been told July 7 his job at the company would be terminated, effective July 31, according to a lawsuit Intel filed against him Friday.
Eight days before his employment was to end, Luo allegedly hooked up an external hard drive to his Intel laptop, but when he tried to download a file, the company’s internal controls blocked the transfer, the lawsuit claimed.

Five days later, the lawsuit alleged, Luo deployed a different technology, a more sophisticated gadget that resembles a small computer server, called a network storage device.

Over the next three days, Luo downloaded nearly 18,000 files, including some labeled “Intel Top Secret,” the lawsuit in Washington State court said.

It was unclear Wednesday if Luo had a lawyer representing him in the case, and he could not immediately be reached for comment.

Intel, accusing Luo of breaking federal and state trade-secrets laws, is seeking at least $250,000 in compensation from him. The company also wants a court order forcing Luo to hand over his personal electronic devices for inspection, and requiring him to give the company its allegedly misappropriated confidential information.

The Santa Clara chip maker, outshone in the public eye by its consumer-facing Silicon Valley neighbors Google, Apple and Facebook — received a turn in the national spotlight over the summer when President Donald Trump announced that the federal government — using previously issued but mostly unpaid grants and funding pledges — was taking a 10% stake in the company.

The lawsuit did not make clear why Luo, of Seattle, was terminated from his job. Intel said in a June regulatory filing that it planned to slash its workforce by 15% this year.

Intel detected Luo’s alleged data transfers and launched an investigation, the lawsuit said.

For almost three months, the company tried to reach Luo — a rundown of Intel’s efforts to contact him takes up two pages of the 14-page lawsuit — but he never responded to the phone calls, emails and letters, the lawsuit claimed.

“Luo has refused to even engage with Intel,” the lawsuit claimed, “let alone return the files.”

news.sophos.com
Written by Ross McKerchar
September 22, 2025

A Sophos employee was phished, but we countered the threat with an end-to-end defense process
If you work in cybersecurity, you’ve probably heard the time-honored adage about cyber attacks: “It’s not a matter of if, but when.” Perhaps a better way to think of it is this: while training, experience, and familiarity with social engineering techniques help, anyone can fall for a well-constructed ruse. Everyone – including security researchers – has a vulnerability that could make them susceptible, given the right situation, timing, and circumstances.

Cybersecurity companies aren’t immune by any means. In March 2025, a senior Sophos employee fell victim to a phishing email and entered their credentials into a fake login page, leading to a multi-factor authentication (MFA) bypass and a threat actor trying – and failing – to worm their way into our network.

We’ve published an external root cause analysis (RCA) about this incident on our Trust Center, which dives into the details – but the incident raised some interesting broader topics that we wanted to share some thoughts on.

First, it’s important to note that MFA bypasses are increasingly common. As MFA has become more widespread, threat actors have adapted, and several phishing frameworks and services now incorporate MFA bypass capabilities (another argument for the wider adoption of passkeys).

Second, we’re sharing the details of this incident not to highlight that we successfully repelled an attack – that’s our day job – but because it’s a good illustration of an end-to-end defense process, and has some interesting learning points.

Third, three things were key to our response: controls, cooperation, and culture.

Controls
Our security controls are layered, with the objective of being resilient to human failure and bypasses of earlier layers. The guiding principle behind a ‘defense-in-depth’ security policy is that when one control is bypassed, or fails, others should kick in – providing protection across as much of the cyber kill chain as possible.

As we discussed in the corresponding RCA, this incident involved multiple layers – email security, MFA, a Conditional Access Policy (CAP), device management, and account restrictions. While the threat actor bypassed some of those layers, subsequent controls were then triggered.

Crucially, however, we didn’t sit on our laurels after the incident. The threat actor was unsuccessful, but we didn’t congratulate ourselves and get on with our day. We investigated every aspect of the attack, conducted an internal root cause analysis, and assessed the performance of every control involved. Where a control was bypassed, we reviewed why this was the case and what we could do to improve it. Where a control worked effectively, we asked ourselves what threat actors might do in the future to bypass it, and then investigated how to mitigate against that.

Cooperation
Our internal teams work closely together all the time, and one of the key outcomes of that is a cooperative culture – particularly when there’s an urgent and active threat, whether internal or affecting our customers.

Sophos Labs, Managed Detection and Response (MDR), Internal Detection and Response (IDR), and our internal IT team worked within their different specialties and areas of expertise to eliminate the threat, sharing information and insights. Going forward, we’re looking at ways to improve our intelligence-gathering capabilities and tightening feedback loops – not just internally, but within the wider security community. Ingesting and operationalizing intelligence, making it actionable, and proactively using it to defend our estate, is a key priority. While we responded effectively to this incident, we can always be better.

Culture
We try to foster a culture in which the predominant focus is solving the problem and making things safe, rather than apportioning blame or criticizing colleagues for mistakes – and we don’t reprimand or discipline users who click on phishing links.

The employee in this incident felt able to directly inform colleagues that they had fallen for a phishing lure. In some organizations, users may not feel comfortable admitting to a mistake, whether that’s due to fear of reprisal or personal embarrassment. Others may hope that if they ignore a suspicious incident, the problem will go away. At Sophos, all users – whatever their role and level of seniority – are encouraged to report any suspicions. As we noted at the beginning of this article, we know that anyone can fall for a social engineering ruse given the right circumstances.

It’s often said – not necessarily helpfully – that humans are the weakest link in security. But they are also often the first line of defense, and can play a vital part in notifying security teams, validating automated alerts (or even alerting security themselves if technical controls fail), and providing additional context and intelligence.

Conclusion
An attacker breached our perimeter, but a combination of controls, cooperation, and culture meant that they were severely restricted in what they could do, before we removed them from our systems. Our post-incident review, and the lessons we took from it, means that our security posture is stronger, in readiness for the next attempt. By publicly and transparently sharing those lessons both here and in the RCA, we hope yours will be too.

[German]A Microsoft software developer has accidentally shared internal PlayReady source code with the public (a developer forum). The data leak of 4 GByte is sufficient to compile the required DLL from the source code. This could be a real boon for people who want to reverse engineering or crack PlayReady. What is PlayReady? PlayReady is...

A 28-year-old United Kingdom man from Fleetwood, Hertfordshire, has been convicted of unauthorized computer access with criminal intent and blackmailing his employer.

An employee of cyberweapon manufacturer, NSO Group, tried to sell advanced malware to unauthorized parties for $50-Million, according to an Israeli indictment unsealed last week against the individual in question. About two years ago, Herzliya-based NSO Group developed a powerful cyberweapon called Pegasus, which operated as malware that exploited three previously unknown vulnerabilities in iPhones […]

Web hosting giant GoDaddy made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. Media coverage understandably focused on GoDaddy's…