TCS Rules Out Data Breach, Says Allegedly Exposed Employee Information Is Over 4 Years Old

New Delhi: Tata Consultancy Services (TCS), India’s largest IT services company, on Monday said it has found no credible evidence of a breach of its systems or customer environments following threat-intelligence alerts alleging the possible exposure of certain employee information.

In a stock exchange filing, TCS said it had investigated the alerts and found that the information referred to in the claims appeared to be more than four years old and was limited to basic employee information.

“This is to inform you that the company has received threat-intelligence alerts alleging possible exposure of certain employee information. The company has investigated the matter and has not found any credible evidence of a breach of TCS systems or customer environments,” it said.

“The information referenced appears to be more than four years old and limited to basic employee information. There is no indication that customer data, customer systems, or TCS operational systems have been impacted,” TCS added.

The company added that it continues to closely monitor its environment and will evaluate any new information that may emerge.

According to the company, the attacker has claimed to have used password spraying and Multi-Factor Authentication (MFA) fatigue as the alleged attack vectors.

TCS said it has had safeguards against such techniques in place for more than two years and that, based on its current assessment, these controls remain effective.

“The attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector. The Company has had strong safeguards in place against such techniques for more than two years,” it said.

“Based on the current review, these controls remain effective, and the Company continues to monitor the environment closely,” the company added.

TCS further stated that it will continue to assess any new information that becomes available and take appropriate action, if required.

“The Company remains committed to maintaining the security and resilience of its systems and to protecting the information entrusted to us,” it noted.

(Except for the headline, this article has not been edited by FPJ's editorial team and is auto-generated from an agency feed.)