U.S. Cyber Firm FireEye Says It Was Breached by Nation-State Hackers

FireEye declined to comment on who it believed was behind the breach. A person familiar with the matter said Russia is currently seen by investigators as the most likely culprit but stressed that the investigation was continuing.

“I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities,” Kevin Mandia, the chief executive at FireEye and a former Air Force officer, said in a blog post published Tuesday. “The attackers tailored their world-class capabilities specifically to target and attack FireEye.”

FireEye said it was working with the Federal Bureau of Investigation and industry partners, including Microsoft Corp. , in a continuing investigation into the incident.

The FBI didn’t immediately respond to a request for comment. Mr. Mandia said the federal investigators shared the company’s view that the breach was the work of a sophisticated foreign government.

People familiar with the investigation said the hackers were disciplined and used a rare combination of sophisticated attack tools, some of which apparently hadn’t been previously used in any known attacks on other victims—an unusual sign of sophistication and resolve—and were specifically dedicated to compromising FireEye.

“This was a sniper shot that got through,” a person familiar with the investigation said.

Based in California, FireEye is among the world’s largest cybersecurity companies, with more than a dozen offices around the world and thousands of employees. The company has been seen as an industry pioneer in detecting and responding to cyberattacks carried out by foreign governments, such as China and Iran, and has often publicly linked prolific hacking groups to specific foreign intelligence services.

In his blog post, Mr. Mandia said investigators were unsure what the hackers intended to do with its compromised “Red Team tools,” which are used by cybersecurity companies to probe the defenses of their customers and identify possible vulnerabilities that can be attacked. He said more than 300 countermeasures had been taken to protect customers and the broader internet community and that so far there was no evidence any of the stolen Red Team tools had been used.

It wasn’t clear when the breach took place or exactly when FireEye was alerted to it, and people familiar with the investigation said the company wasn’t certain how the assailants broke into its systems.

Dmitri Alperovitch, a cybersecurity expert who was briefed on details of the breach, said other security companies, such as RSA and Kaspersky Lab, had been compromised in the past by government hackers.

“They do this to gain insights that can help them defeat security countermeasures and enable hacking of organizations all over the world,” said Mr. Alperovitch, co-founder of the Silverado Policy Accelerator think tank and a former executive at CrowdStrike, a cybersecurity firm that competes with FireEye. “With FireEye rapidly coming forward and transparently disclosing what happened to them, as well as disclosing the Red Team tools stolen by the adversaries, they are helping to minimize the chances of others getting compromised as a result of this breach.”

Because they are trusted with a level of network access by their customers, cybersecurity companies are an appealing target for hackers who in turn can leverage their access to break into systems that belong to clients. In 2011, the vendor RSA Security LLC was breached by hackers that the National Security Agency linked to China, which denied involvement. The point of the hack, security experts believe, was to gain access to RSA’s encryption technology, which could then be used in attacks on its clients.

“Over a two-week period they were in there, it was a cat-and-mouse game,” RSA’s former chief executive, Art Coveilo told The Wall Street Journal last year. RSA eventually called Mandiant to investigate the hack. RSA didn’t immediately respond to an email seeking comment.

—Robert McMillan contributed to this article.