Trellix source code repository breach claimed by RansomHouse

On 4 May 2026, Trellix, the cybersecurity company created in 2021-2022 from the merger of McAfee Enterprise and FireEye, disclosed that it had "recently identified unauthorized access to a portion of our source code repository." The company said it was working with forensic experts and had notified law enforcement.

Trellix stated that it had found no evidence that its source code release or distribution process was affected, or that its source code had been exploited. It did not say how the intruders got in, how long they had access, or which products' code was involved.

Claim of responsibility

On 7 May, the RansomHouse extortion group listed Trellix on its data-leak site and published screenshots that it said showed access to the company's appliance management systems. A Trellix spokesperson said the company was aware of the claims and looking into them, without confirming a link between the group and the intrusion.

Why it matters

Trellix products protect tens of thousands of enterprise and government customers. Source code for a security vendor is a high-value prize: it can show attackers where detection logic lives and where weaknesses in agents or update paths might be found. The breach came amid a run of 2026 intrusions into security and developer-tool vendors, several of them linked to the theft of build and CI credentials.