F5, source code stolen by a state actor: systemic risk in waiting

On 15 October 2025 F5 disclosed that a state actor had stolen portions of BIG-IP source code and information on unpublished vulnerabilities, and CISA issued an emergency directive. The analysis: the theft that prepares the claims, state-actor exclusions, the loss to the vendor and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, October 2025 · by cybercoverinsurance

On 15 October 2025 F5, one of the main makers of traffic management and security appliances for corporate networks, disclosed that a nation-state actor had had prolonged access to its systems and had stolen portions of BIG-IP source code and information on vulnerabilities not yet published. The same day CISA issued an emergency directive to federal agencies. F5 had discovered the intrusion on 9 August and delayed disclosure at the request of the Department of Justice.

For cyber underwriters the case is a systemic risk in waiting: it produced no known claims, but it put in the hands of a state actor the code and vulnerabilities of products installed at the edge of thousands of networks. It touches three themes: aggregation on a security vendor, state-actor exclusions and the loss to the vendor itself.

What is known

The intrusion. According to F5's Form 8-K, the company learned of the breach on 9 August 2025. The perpetrator is described as a highly sophisticated nation-state actor with long-term persistent access. Bloomberg reported at least twelve months of access and linked the intrusion to the BRICKSTORM malware, attributed to a China-nexus group. The stolen material included portions of BIG-IP source code, information on vulnerabilities F5 was fixing and configuration data for a small percentage of customers. F5 said it had seen no exploitation of the vulnerabilities (The Hacker News).

The directive. CISA's emergency directive ED 26-01 required federal civilian agencies to inventory BIG-IP products, check whether management interfaces were reachable from the internet, apply updates by 22 October and report the inventory by 29 October. CISA spoke of an "imminent threat" to federal networks. F5 rotated credentials, certificates and signing keys, supported by Mandiant and CrowdStrike (The Hacker News).

The effect on the vendor. On 27 October F5 guided fiscal 2026 revenue growth of 0 to 4%, against 10% the previous year and mid-single-digit growth expected before the breach. The company expects slower sales cycles while customers assess and secure their environments, especially in the first half. The shares fell more than 6% after the results (SiliconANGLE).

What is not known. How many BIG-IP devices are exposed to the internet with reachable management interfaces, which customers had configuration data taken, and whether the stolen information was used in later attacks have not been made public.

The theft that prepares the claims

Stolen code is a time advantage. With the source code and the list of vulnerabilities still to be fixed, an attacker can look for flaws before they are closed. As Unit 42 noted, finding exploitable flaws takes time (The Hacker News). The claim, if it comes, comes later, and across many insureds at once.

The products sit at the network edge. BIG-IP appliances manage traffic to applications and services, often exposed to the internet. A vulnerability exploited on these devices opens access to the internal network. It is the same type of product that has produced waves of mass exploitation in the past.

An exposed management interface is the risk factor. The directive first asked agencies to check whether management interfaces were reachable from the internet (The Hacker News). It is a simple question to put to insureds, and a data point an external scan can confirm.

The state actor and exclusions

Espionage theft, not an act of war. The theft of code by a state-linked group is cyber espionage. The state-act exclusions introduced in recent years usually look at attacks that impair the functioning or security of a state. The theft at F5 hardly falls within them.

Later exploitation is another story. If a state actor later used the vulnerabilities to attack critical infrastructure, the same exclusions could come into play for the insureds hit. The same origin can produce claims paid in one case and excluded in another, depending on the target and the effect.

Attribution came from the press. F5 spoke of a nation-state actor without naming it. The link with China comes from Bloomberg (The Hacker News). For wordings that require official attribution, the distance between the company's statements and the press matters.

The loss to the vendor

The first loss is commercial. F5 did not report significant direct costs, but cut its growth guidance (SiliconANGLE). For a security vendor, lost trust turns into postponed sales. It is a real loss that cyber policies usually do not cover: loss of future revenue from reputational damage has limited, narrowly defined cover.

Liability towards customers remains open. Customers whose configuration data was taken, or who are hit in future through vulnerabilities found thanks to the stolen code, could turn to F5. For insurers of a security vendor, professional liability towards customers is the most exposed line.

What to bring to renewals

Impact for insurersHigh

A state actor stole source code and unpublished vulnerabilities for a product installed at the edge of thousands of networks, creating a risk of future exploitation across many insureds at once.

On the portfolio side, the F5 case suggests knowing how many insureds use the same internet-facing network appliances. A vulnerability mass-exploited on these products is an aggregation scenario that does not depend on an event already happened, but on preparation already made.