A former IBM cybersecurity executive has accused the company of repeatedly being hacked and covering up these incidents, a claim that highlights the ongoing struggle with cybersecurity in large corporations.

William Barlow, who was IBM’s vice president of threat intelligence until August 2019, filed a lawsuit in 2020 alleging that IBM concluded Chinese hackers breached its core network between 2013 and 2016 but never disclosed the breaches. He also claims at least two IBM subsidiaries were hacked and that both incidents went unreported.

Barlow's complaint states that 'IBM’s core network was “routinely hacked by foreign state actors and others,”' adding that data theft occurred frequently without notification to government agencies. The case is particularly significant given IBM's role as a major cybersecurity vendor to the U.S. federal government, which has seen several data breach notification laws passed in recent years.

Despite acknowledging the breaches, IBM spokesperson Miki Carver said, 'This complaint was filed six years ago, and the U.S. Department of Justice declined to intervene. IBM is confident that our actions followed the letter of the law.' Barlow's lawyer, Jason Brown, disagrees, stating, 'You can’t sell cybersecurity to the federal government while allegedly having these security problems within your own company.'

Barlow also alleged that in March 2017, intelligence officials from the Five Eyes alliance warned IBM about a breach involving APT 10, a Chinese government-linked group. The investigation concluded that APT 10 potentially breached IBM’s network more than 56,000 times between 2013 and 2016 due to poor logging practices.