Swiss telecommunications company Ascom has disclosed a cyberattack on its IT infrastructure, confirming that the hacker group HellCat exploited compromised credentials to target Jira servers worldwide.

In an official statement, Ascom revealed that its technical ticketing system was breached on Sunday. The company has since launched an investigation to assess the impact of the attack.

With a presence in 18 countries, Ascom specializes in wireless on-site communication solutions. The HellCat hacking group has taken responsibility for the breach and informed BleepingComputer that it has stolen approximately 44GB of data, potentially affecting all divisions of the company.

Ascom assured that despite the intrusion into its technical ticketing system, the attack has not disrupted business operations. The company emphasized that its customers and partners do not need to take any precautionary measures.

“Investigations against such criminal offenses were initiated immediately and are ongoing. Ascom is working closely with the relevant authorities.” – Ascom

Rey, a representative of the HellCat hacking group, claimed that the stolen data includes source codes for multiple products, project details, invoices, confidential documents, and issue logs from Ascom’s ticketing system.

While Ascom has not shared technical specifics about the breach, HellCat has a track record of exploiting Jira ticketing systems, which are commonly used by software development and IT teams. These platforms often store critical data such as source code, authentication keys, IT roadmaps, customer information, and internal project discussions.

HellCat’s Widespread Jira Exploits

HellCat has previously been linked to cyberattacks on major corporations, including Schneider Electric, Telefónica, and Orange Group, all of which suffered breaches through their Jira servers.

Recently, the group also claimed responsibility for hacking British automaker Jaguar Land Rover (JLR), leaking around 700 internal documents. According to the hackers, the stolen data includes development logs, tracking information, source codes, and sensitive employee records.

“At the heart of this latest incident lies a technique that has become HELLCAT’s signature: exploiting Jira credentials harvested from compromised employees that were infected by Infostealers.” – Alon Gal, Co-founder and CTO, Hudson Rock

Gal noted that the JLR breach occurred through credentials belonging to an LG Electronics employee with third-party access to JLR’s Jira server. He further pointed out that these compromised credentials had been exposed for years but remained valid, enabling the hackers to infiltrate the system.

HellCat’s cyber activity has continued, with the group announcing another breach—this time targeting Affinitiv, a marketing and data analytics company serving OEMs and dealerships in the automotive sector. The hackers claim to have accessed Affinitiv’s Jira system, stealing a database containing over 470,000 unique email addresses and more than 780,000 records.

Affinitiv has acknowledged the reported attack and confirmed that an investigation is underway.

To validate their claims, the hackers have published screenshots revealing names, email addresses, postal addresses, and dealership details.

Cybersecurity experts warn that Jira has become a prime target for attackers due to its role in enterprise workflows and the vast amount of sensitive data it contains. Gaining unauthorized access can allow threat actors to move laterally, escalate privileges, and exfiltrate critical information.

Given the ease of acquiring credentials compromised by infostealers and the fact that many remain unchanged for extended periods, experts caution that such attacks may become increasingly common.