Exclusive-Apple supplier Tata tightens internal controls after data breach, sources say

By Munsif Vengattil and Aditya Kalra

NEW DELHI, June 26 (Reuters) – Tata Electronics, a key Indian supplier to Apple, has restricted internal access to sensitive systems as it investigates a leak of thousands of secret client files on the dark web, a Tata source and two industry officials said.

Tata has also hired a global consultant to conduct a forensic audit and has reported the incident to the Indian government and its clients, said the Tata source, declining to be named given the sensitivity of the matter.

Reuters reported this week that ransomware group World Leaks posted more than 200,000 files to the dark web, including purported component design papers from Apple and Tesla, both of which are Tata clients. Reuters could not verify the authenticity of ​the data.

Tata has said it had identified a “cybersecurity incident” and there was no impact on operations, without providing additional details.

Reuters found that the leak also contains at least 16 files and folders of purported documents from Taiwan Semiconductor Manufacturing Co (TSMC) and 23 from Qualcomm, both of which make parts used in iPhones.

After it detected the breach, Tata Electronics tightened internal security protocols at all its facilities and offices to restrict remote access to sensitive internal tools, such as those used to place purchase orders, only to select employees, said the Tata source and two people briefed on the matter.

Earlier, access to such internal tools was more liberal, the Tata source said, adding that while work-from-home is still allowed, “only select people have remote access” to such tools. The changes apply to Tata Electronics broadly and are not restricted to a few factories.

“Tata Electronics has hardened access to its sensitive internal systems,” the Tata source said. “The investigation is ongoing.”

Tata Electronics, Apple, TSMC and Qualcomm did not respond to Reuters queries. All sources cited in this article declined to be named given the sensitivity of the matter.

The Indian Computer Emergency Response Team, a unit under India’s IT ministry that received the Tata incident report, also did not respond.

APPLE WORKING WITH TATA

One of the industry officials added that tighter controls included making Tata’s official network access more strictly regulated when employees access it from outside the company’s facilities.

Apple’s security team is working closely with Tata on near- and long-term measures following the incident, the person added.

Reuters is first to report details on the internal process changes and the forensic investigation at Tata Electronics.

With former Intel and Applied Materials executive Randhir Thakur as its CEO, Tata Electronics is part of the salt-to-aviation Tata conglomerate. It was set up in 2020. Its businesses extend to semiconductors, but Tata is one of Apple’s most important Indian suppliers and it is central to the American firm’s effort to make more iPhones outside China.

The breach is also a setback for Apple’s supply ⁠chain. Tata also faces scrutiny over the alleged contamination of farmlands near one of its iPhone parts plants in India. Separately, Tata was hit by a cyberattack at its British ​Jaguar Land Rover unit last year, which resulted in a six-week output halt.

TSMC AND QUALCOMM PAPERS

World Leaks, which has previously claimed responsibility for a Nike break-in, said on its dark net website that it has published more than 204,341 files containing Tata Electronics data totalling over 630.4 gigabytes.

Reuters reported previously that the searchable database shows several files from Apple and Tesla, but further reporting showed that purported documents from more companies were leaked.

One 2022 document, marked “TSMC Secret,” contained purported “product reliability test” details of a TSMC component with photographs. An “Apple Silicon Engineering Group” document from 2023 maps Apple parts numbers to TSMC’s numbers, with details of Apple employees in the document’s revision history.

A purported Qualcomm document from 2021 shows mechanical information on the functioning of a power management integrated circuit with drawings, watermarked “Confidential – May Contain Trade Secrets.”

The World Leaks website is only accessible on the dark web, meaning it is beyond the reach of search engines. Reuters was not able to reach World Leaks for comment.

India is on track to make 26% of the world’s iPhones in 2026, up from 6% four years ago, according to Counterpoint, a research firm.

(Reporting by Aditya Kalra; Editing by Tony Munroe and Thomas Derpinghaus)