cases where companies suffered losses due to leaks of source code?

Question

The damage associated with data breaches apparently caused Equifax to lose $4 billion in value and Facebook to lose about $50 billion, and even if not every dollar of those losses was due to the breaches, it was a lot.

By contrast, have there been cases where companies were seriously hurt or lost market value because their source code was compromised? I heard about Windows source code leaking last summer but not about it affecting Microsoft's stock price or even hurting the company.

Maybe the reason is that even if an outsider stole the entire source code, they still wouldn't be able to sell it legally, so it wouldn't represent a competitive threat to the company. Possibly a thief could use the source code to determine how a competitor is doing something, but that just helps the thief make a product that does the same thing, at the same level of quality; that's not going to steal market share from an entrenched incumbent. There is the risk of attackers finding security holes in the source code, but they were probably already looking for security holes through reverse engineering anyway.

Regardless of speculation over the reasons, I'm just asking: have companies been hurt by a breach of their product's source code? How much?

Answer 1

I can think of numerous cases over many years especially in cases of start-ups. The theft of IP (intellectual property) allows other companies to get to market first. You do not hear of these cases because the companies are so small, but the damage is total: companies shut down before they really start.

The same is true in research circles when an academic wants to bring research into the commercial market. There can be massive competition and corporate espionage is very real.

And the source code does not need to be used exactly as it was stolen. Parts of the code can be used, or the code analysed in order to create something better.

You also need to define "harm". Loss in stock price is only one form of harm. Loss of sales is another. Software piracy is another form of harm (sales), depending on how you define it (yes, I am aware that this is a complex issue).

If you think about it another way, every single (valid) software patent case is a form of IP theft that resulted in harm, which resulted in a lawsuit to recover losses.

Examples of "source code leaks" in the InfoSec industry alone:

RSA SecurID token source code leak: RSA needed to replace all user's physical tokens. So, there's a direct cost. In the community I was in at that time, we all started to seriously look at software tokens instead as a result of this event (Google Authenticator was released the year before). That financial hit would be difficult to quantify.

RSA is an LLC, and not a public company, so there is no stock price to track.

Symantec source code leak: While the stock price did not take a hit, it shook confidence in the detection engine as hackers could custom design malware that could evade this specific detection engine. This caused a re-write of their code, so there's a direct cost.

There are lots and lots of examples if you know what you are looking for. Including Wiki.

Answer 2

Possibly a thief could use the source code to determine how a competitor is doing something, but that just helps the thief make a product that does the same thing, at the same level of quality; that's not going to steal market share from an entrenched incumbent.

Quite the contrary!

I'm always amused when some enterprising secretary steals the formula for Coca-Cola or Pepsi and tries to sell it to the competition. Why would Pepsi be interested in making Coke? Their entire brand is Pepsi!

The smarter thing to do would be to take the recipe and go to a chemist/bottler, produce your own syrup and become a distributor selling the same thing of same quality for a cheaper price than the entrenched incumbent. "Bleeding the beast" is what it's called. While it would be advantageous for Pepsi to do something like this to undermine Coke, with both of them being domestic companies no sane CEO would implicate themselves in such a scheme.

My current employer has to deal with this headache. We spent millions of dollars on R&D and eventually partnered with an overseas firm to do some engineering work. They stole our designs, produced the product themselves and beat us to market. Now we're having to compete with an inferior version of our own product.

What's worse, they can afford to undermine us on price since they don't have any R&D costs to recoup. What we spent on initial development, they're spending on feature enhancement.

So, don't be so quick to assume that selling the same thing as the incumbent is somehow not worth the effort. If you're selling it, that's revenue the incumbent isn't getting, and you didn't have to do any of the actual work involved in getting to that point.

Answer 3

I am not aware of any such case and I agree with your hidden bias in your question: I can hardly think how stolen source code may seriously harm a company. Note leaked source code is very different from leaked data or from being hacked otherwise.

In fact, it becomes more and more popular to openly publish source code, even for products which are not under a FOSS license.