F500 Tech & Semiconductors · Information Technology Services · Data breach
IBM
Headline
IBM appears in this tracker in multiple roles simultaneously - as a breach victim, as a vendor whose software sits inside other companies' incidents, and as a security provider selling the remedy.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
IBM appears in this tracker in multiple roles simultaneously - as a breach victim, as a vendor whose software sits inside other companies' incidents, and as a security provider selling the remedy. That triple position is the finding, and it generalises: in enterprise technology the same handful of firms are the attack surface, the incident responder and the auditor, which makes genuinely independent assessment of any of them difficult to obtain. IBM has essentially no direct consumer relationship today; its consumer relevance is entirely through systems that hold your data on someone else's behalf.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — IBM primarily serves enterprise/government customers rather than individual consumers directly.
Data sharing
IBM appears in MULTIPLE roles across this tracker: (1) as a NAMED VICTIM whose credentials were exposed in the Cisco/Red Hat GitLab breach (see Cisco row, this same tab); (2) as the BUSINESS ASSOCIATE managing Johnson & Johnson's Janssen CarePath patient-assistance platform, which was itself breached in 2023, resulting in IBM being named as a CO-DEFENDANT in the resulting patient class action (see Johnson & Johnson row, F500 Pharma & Biotech tab).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy ibm.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service ibm.com/legal/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.