Cybersecurity firm Trellix disclosed a data breach after attackers gained access to “a portion” of its source code repository.

Trellix is a global cybersecurity company formed from the October 2021 merger of McAfee Enterprise and FireEye. It provides services to over 50,000 business and government customers worldwide, protecting more than 200 million endpoints.

According to an official statement updated on Monday, the company is now investigating the incident with the help of outside forensic experts.

At the moment, Trellix said it has yet to find evidence that the threat actors have exploited or altered the source code they accessed.

“Trellix recently identified unauthorized access to a portion of our source code repository. Upon learning of this matter, we immediately began working with leading forensic experts to resolve it,” Trellix says.

“We have also notified law enforcement. Based on our investigation to date, we have found no evidence that our source code release or distribution process was affected, or that our source code has been exploited.”

A Trellix spokesperson shared the same statement when BleepingComputer asked for more details about the breach, including when it was detected, whether the attackers had also stolen corporate or customer data, and whether they had sent a ransom demand.

While Trellix has yet to reply to a subsequent email requesting more information regarding this security incident, the company says in its official statement that it intends “to share further details as appropriate” after the investigation ends.

Trellix isn’t the first cybersecurity company whose systems were breached since the start of the year.

Application security company Checkmarx confirmed last week that the LAPSUS$ hacking group leaked data stolen from its private GitHub repository, while Cisco revealed last month that hackers breached its internal development environment and stole source code using credentials compromised in the recent Trivy supply chain attack.

Bug bounty platform HackerOne also notified hundreds of employees in March that their personal information had been stolen by attackers who hacked Navia, one of its U.S. benefits administrators.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Advertisement

Claim Your Spot

Smart meters are designed to make life better, but like any smart tech, they can and will go wrong, often without the energy company even telling you. The need for constant vigilance feels like yet another thing that I have to be in charge of. Shouldn’t things be better?

I hadn’t upgraded to a smart meter until recently, as there didn’t seem much point until I was going to have solar installed, and needed one to both see how much power I was using (and if I was in deficit), and to monitor how much power I was exporting, so I could get paid for it. 

I contacted Octopus and arranged a quick appointment to have a smart meter fitted. It should be easy, I thought, but no. The engineer turned up, looked at the small cupboard where the current dumb meter was, lined up the new smart meter with its large communications hub, and immediately said that it wouldn’t fit.

That, I thought, was it, until he came back half an hour later and said that there’s an adaptor that lets the communications hub be placed elsewhere (but still near to the meter), and that it should just fit. Luckily, my broadband had just been upgraded to fibre-to-the-home, so the old BT box in the cupboard could be removed.

The outdoor gas meter was easy to replace with a new one because there was much more space. The gas meter talks to the communications hub inside, using a secure Zigbee connection, and this hub then transmits data back to the energy company via the mobile-powered WAN operated by the Data Communications Company (DCC). 

All modern SMETS2 smart meters use the same network, so you can swap between energy providers and keep the same meter. The smart meter was installed on 10 November, and started working immediately for gas and electricity.

Alongside the smart meter, I had the new Octopus Home Mini, a small hub that replaces a traditional In-Home Display (IHD). The advantage of the Home Mini is that it lets me track live energy usage from the Octopus app, which is handy to see when there’s excess solar power and, therefore, worth using energy-heavy appliances, such as the washing machine or tumble dryer.

This app doesn’t send notifications when I’m exporting a lot of electricity, which would be useful. When I wrote about Time Of Use (TOU) tariffs, one of my complaints was that smart meters don’t do enough to help you use power more efficiently automatically.

Problem 1 – My gas usage almost tripled overnight

One of the benefits of a smart meter is that you can see how much energy you’re using. Once you start to see how much everything costs, you start to think about your energy usage; with the old system, being billed monthly means you have no idea when you used a lot of power.

So, smart meters are generally good, but I had a panic attack when I saw how much gas I was using. It was a cold winter, that’s for sure, but there were days when the Octopus app would show usage of £20+. That’s with the Tado X system installed and quite tight schedules that mean we only heat the rooms we’re in.

We tightened further, but even on days when we barely used any heating, the cost was huge.

Then, I looked into it. Our old manual gas meter read usage in cubic feet (imperial), the new one in cubic metres (metric). There’s then a conversion process to convert the usage into kWh, which is how you’re finally charged.

If your utility company knows what unit your meter is measuring, it can apply the correct formula. In my case, the old meter was still registered, so Octopus thought that everything was in cubic feet. The short version is that the calculation increased the kWh figure by almost three times.

That’s a big difference, and it feels like the kind of thing that should be flagged automatically – there’s no way we could possibly use that much gas, unless something was wrong. Instead, I had to contact Octopus, which rectified the mistake and got the right readings.

Problem 2 – Exports weren’t applied

After signing up to export excess solar energy, I was accepted for Outgoing Octopus on 18 December (originally this paid 15p per kWh, but the rate has been slashed to 12p per kWh).

A new dashboard appeared in the app, updating after a couple of days to show how much power my solar system had exported and how much I would earn. Export earnings are supposed to be paid monthly, but by 27 February 2026, I had the grand sum of nothing.

Getting in touch with Octopus, it turns out that the credits weren’t being applied, after all. The change, I was told, would happen, and future credits would be applied each month.

Again, Octopus has the data, it knows I have solar, it knows I have an export tariff, and it has the readings, so why is none of this handled automatically?

Problem 3 – Smart meters are finicky about their connection

My smart meter, which had been working since 10 November 2026, stopped communicating with Octopus on 9 March 2026. Was it because I got an alert from Octopus that suddenly it couldn’t read my meter? No, it was because the app stopped updating: no outgoing, no electricity and no gas readings.

I got in touch with Octopus to see if someone could have a look, as the smart meter had all of its indicator lights showing that it was working. Instead, I had to take photos, check the mobile reception at the meter, and answer a lot of questions.

The solution I was originally offered, was to move the multi-way power strip in the cupboard (this powers the router, the Octopus Home Mini and a radiator fan). Apparently, according to the email, “The communications hub itself works using long-range radio waves, so any metallic or electrical cabling nearby can obstruct the signal.”

It’s the “electrical cabling” part that drew my attention. Smart meters are installed near the consumer unit, so naturally have a lot of “electrical cabling” around them. If this is an issue, then shouldn’t smart meters have an option to move the communications hub further away?

My gas meter communicates with the communications hub using Zigbee (and to the IHD using the same protocol); the smart electricity meter uses Zigbee to talk to an IHD; so, why can’t both meters just use Zigbee to a communications hub that could be better placed for a strong signal? This isn’t Octopus’ fault, but the way that all smart meters are designed.

In any case, my meters stopped communicating, and nothing had changed. The smart meter and communications hub were installed with the power strip where it was, and it worked for three months without a problem. If any of what was in the cupboard was going to cause an issue, then the smart meter should not have been fitted where it was.

And the communications hub’s lights were flashing in the correct order to indicate it still thought it was connected. 

Stubbornly, I refused to move anything, and the smart meter started working again on 22 March with no intervention.

Despite smart meters being designed to store data in the event of a communication failure (they hold 13 months of data), the day-by-day readings are still missing from my account.

Problem 4 – I didn’t get paid again

On 28 March, I went into the Octopus app and took a look at the meter reading history. In this part of the app, I have three meters listed: export electricity (what I send to the grid), import electricity (what I consume from the grid) and gas. With the two import meters (gas and electricity), I have the option to switch between Usage (daily readings) or Readings (the amount read on a set date by Octopus – the monthly reading).

The export section only gives me the monthly reading option, but if I switch to either of the import meters and change the setting to ‘Usage’, I can then switch back to the export and view the daily option instead. Seems like a bit of the interface is broken.

I digress. On 28 March, I noticed that there was a reading for my Export. As the bill hadn’t been generated, I wanted an idea of how much income I could expect. I planned to do this by working out the number of kWh of electricity I had exported by taking the current reading (28 March) and subtracting the previous reading (1 March). I opened up my phone’s calculator, then switched back to the Octopus app only to find that the 28 March reading had disappeared from the export meter. The import readings were there.

My bill was generated, but it only included what I’d imported, not what I’d exported. On 9 April, I had to contact Octopus again, asking why the export meter reading wasn’t showing. Not long after, a new email came through saying that -£13.01 had been applied to the account.

The following day, Octopus replied to say, “I can see that your export statement was issued yesterday. I do apologise for the delay in this.

Looking into it, your import statement was generated and issued before the export credits were applied, which caused the export statement to be delayed.”

So, by my reading of this, the export meter had been read, but there was just a delay in applying what Octopus owed me, which caused a billing error and the export reading to disappear from the app. Checking the app, the 28 March export reading was there again.

All should have been good, but Octopus had scheduled a Direct Debit payment for the bill without including the export amount (I pay the full bill monthly, as I don’t like spreading payments over the year based on what any energy company thinks I might spend).

At the point the direct debit payment is set up, it can’t be changed.

Talking to Octopus on 13 April, the follow-up suggests that the export information hadn’t been read on the 28 March.

As per the email, “We always try to get the import and export data/ meter readings on 28th of each month. If the meter reading is not available at the time, the automated billing system will try again on 28th of next month. Whilst we are your energy supplier, there will never be an instance where you export energy without getting credited for it. You will always be credited, but it will require manual intervention to bring this to date if the connection is not there on 28th.”

This is confusing. Why did one person say that it was because “import statement was generated and issued before the export credits were applied, which caused the export statement to be delayed” and another say it was because the export meter reading wasn’t available at the time?

Given that all readings come from the same communications hub, it’s funny how the readings work for the bit where I owe money, but didn’t for the bit where I’m owed money. 

If the export meter couldn’t be read on the 28 March, then shouldn’t the system automatically email to say that this is the case? Again, Octopus knows that I have solar, and it knows I have an export tariff, so any failure should surely be communicated.

Be more proactive

Praise be, as of the end of April, all meter readings were taken on the correct day, and the correct bill was generated, including the credits for export solar. That at least saves me from having to leave a special voicemail that Octopus could use in one of its radio adverts, although my message would only be able to be broadcast after the watershed and with a few liberal beeps.

Smart meters should make life easier. They automatically transmit up-to-date readings, eradicating estimated bills. That’s great when they work, but my experience shows that you really need to keep on top of everything, as when things stop working, there’s no communication to warn you of potential problems. Surely it can’t be that difficult for energy companies to know what to expect and then communicate in the event of an issue, proactively fixing problems? 

Twice now, over the last 24 years, Colin Angle has surprised me. I’m not talking bemusement or nodding appreciation. Think jaw-dropping moments when I felt the earth shift a bit under my feet. The first time was in 2002 when he unveiled the iRobot Roomba, a rather basic-looking but shockingly effective robot vacuum, and the second was today, when he showed me a video of his new companion robot, the dog-sized Familiar.

Angle and I have spent decades talking about the robot revolution, or rather, having frank discussions about the reality of that not-quite-yet-here robot uprising. He’s the one who cautioned me years ago that functional home humanoid robots wouldn’t arrive until 2050. And when he rang me up to talk about his new product under the banner of “Familiar Machines and Magic”, I wondered if perhaps he, too, had drunk the Kool-Aid and now believed that humanoid robots like Tesla Optimus, Neo Beta 1, and Figure 03 were all ready to join me in my kitchen or living room. I needn’t have worried.