IBM and AT&T Face Whistleblower Lawsuit Over Alleged Cover-Up of Foreign Government Hacks

William Barlow, IBM's former vice president of threat intelligence, filed a complaint in 2020 claiming that foreign hackers repeatedly breached computer systems at IBM and AT&T. The companies then concealed those intrusions from the U.S. government, according to the lawsuit. The complaint remained under seal until this week, when it became public after the government declined to intervene.

The hackers allegedly penetrated massive IBM cloud computing infrastructure used by multiple parts of the U.S. government, including the military. AT&T operates this Core Network on behalf of IBM, and its systems were also compromised, the complaint states. Barlow asserts the companies made false assurances about their security to win and keep federal contracts. The case is pending before a federal court in New York.

The lawsuit's emergence in 2026, six years after filing, follows a pattern where major corporate whistleblower cases only surface after government prosecutors pass on intervention. The Justice Department's decision not to join the case allowed Barlow to proceed alone, triggering the unsealing.

This timing lands amid intensified scrutiny of government contractors' cybersecurity practices. Federal agencies have pushed harder for breach disclosure since high-profile incidents like the SolarWinds hack exposed gaps in contractor accountability. The complaint's allegations, if proven, would represent a direct violation of legal obligations to report compromises of systems handling government data. The suit offers a rare window into alleged security failures at two of the largest contractors serving federal clients.

The alleged breaches center on infrastructure that IBM and AT&T have jointly operated for years. AT&T manages the Core Network that delivers IBM's cloud services to government customers, making the two companies deeply interdependent on this contract. This arrangement dates back to at least 2014, when the companies announced enhanced security capabilities for hybrid IT environments.

That earlier collaboration promised advanced visibility and control across diverse IT environments, reduced complexity, and simplified infrastructure. The whistleblower complaint now suggests those same systems suffered intrusions that went undisclosed. The gap between public security claims and private incident response raises questions about how thoroughly government customers can audit contractor security postures. Federal contracts typically require immediate disclosure of suspected foreign government breaches.

This is not the first time IBM has faced accusations of hiding risks from investors and government stakeholders. In 2013, a shareholder lawsuit accused IBM of concealing how its ties to the NSA's Prism surveillance program damaged its business in China. The Louisiana Sheriffs' Pension and Relief Fund alleged IBM lobbied Congress to allow sharing customer data with the NSA, which then caused Chinese customers to cut ties.

That earlier suit claimed IBM's China sales dropped 22 percent and hardware sales fell 40 percent in a single quarter after Snowden's disclosures. IBM lost over $12 billion in market value. The whistleblower complaint now adds a different dimension, alleging active concealment of breaches rather than passive failure to disclose business risks. Together, the cases paint a picture of a company repeatedly handling sensitive security information in ways that protected contracts over transparency.

The lawsuit's progression will test whether whistleblower claims can penetrate the legal shields that protect classified contract details. Barlow's case proceeds under the False Claims Act, which rewards individuals who expose fraud against government programs. If the court finds merit, damages could run to billions given the scale of IBM and AT&T's federal business.

Broader consequences may reshape contractor disclosure rules. The Biden administration has already tightened cybersecurity requirements for federal suppliers, and this case could accelerate mandatory breach reporting timelines. Cloud providers serving intelligence and defense customers face particular pressure to demonstrate they can detect and report nation-state intrusions promptly. For IBM and AT&T, the immediate risk is reputational and financial, but the operational risk is losing access to contracts that underpin significant revenue streams.