Cybercriminal claims access to Check Point

Hacker claims access to Check Point systems

A hacker using the alias CoreInjection is claiming to have breached the Israeli cybersecurity company Check Point. According to the hacker, the breach includes access to sensitive internal data and core systems. While the claim has sparked concern in the cybersecurity community, Check Point denies that any significant breach has taken place.

The hacker’s claim

On March 30, CoreInjection published a post on a cybercrime forum, offering alleged access to Check Point’s internal network. The post included screenshots showing what appeared to be internal directories and server information. The hacker stated that the access was gained a day earlier, on March 29, and that it includes files related to source code, customer data, and internal tools.

The access is being offered for sale privately, without a fixed price, indicating that CoreInjection is seeking bids from potential buyers.

For comparison, similar breach tactics were seen in the Tata Technologies ransomware attack, where attackers targeted corporate infrastructure and leaked stolen data.

Who is CoreInjection?

CoreInjection is a relatively unknown hacker who has recently become active on cybercrime forums. While not previously associated with any high-profile attacks, the user has posted about exploits and vulnerabilities in the past. This new claim involving Check Point has brought the hacker into the spotlight, with many questioning whether the breach is real or exaggerated.

Some researchers are treating the claim with caution, while others point out that the screenshots could be legitimate, although taken from a non-sensitive environment.

Check Point responds

Check Point has responded to the claim by confirming that a single test environment was accessed. However, the company stresses that this environment was isolated from production systems and did not contain any sensitive information. The affected system was quickly shut down, and an internal investigation is ongoing.

According to Check Point, there is no evidence that customer data or critical infrastructure has been compromised. The company describes the incident as a limited event and maintains that there is no broader risk.

A Question of credibility

It is not uncommon for hackers to exaggerate or even fabricate breach claims in order to gain attention or increase the value of stolen data. In some cases, old or publicly available information is repackaged to appear new and more damaging than it really is.

This creates a challenge for both companies and the security community, especially when the target is a cybersecurity firm that holds a reputation for protecting others.

In some cases, as seen in the Medusa ransomware case, real damage is hidden behind misinformation tactics designed to amplify fear.

Why it matters

Regardless of whether the breach is real, the situation shows how quickly trust can be challenged. When a cybersecurity provider becomes the focus of a breach claim, it raises questions about its own security posture. Read more about what security posture is and why it matters in our article here. Even if no sensitive data was accessed, the publicity around the claim can damage client confidence and brand reputation.

Check Point has acted quickly to investigate and reassure stakeholders, but the case remains a reminder that threat actors are constantly looking for opportunities to make an impact — whether technically, financially, or reputationally.