AI data giant Alation confirms cyberattack after earlier outage

Enterprise data giant Alation confirmed a cyberattack on Thursday, days after reporting an incident affecting a number of its customers. Alation makes data software that enterprise customers use to search files and data with natural-language queries, and has expanded into AI in recent years, letting customers turn large amounts of messy data into usable content. The company says it serves more than 500 global companies, including around half of the Fortune 1000 largest companies in the United States.

“Alation recently identified an isolated incident involving unauthorized activity in one of its systems,” the company said in a statement provided to TechCrunch by external representative Stephen Russell. “We are conducting a thorough investigation of what occurred and we will provide additional information as appropriate.” Alation did not specify the nature of the attack, the root cause, or how many customers are affected, and did not say whether it had alerted customers or what defensive actions, if any, they should take.

On Tuesday, Alation reported a separate, unspecified incident that resulted in “degraded availability” for some of its customers, which it said it resolved within an hour. Much of the company’s systems are hosted on Amazon Web Services, and it’s not immediately clear whether any data was stolen or exfiltrated during the incident.

This is the latest cybersecurity incident in recent weeks to affect a large-scale technology company, as hackers increasingly target companies that store large amounts of sensitive or proprietary information for their corporate customers — following data thefts reported by several companies after a breach at European shipping giant Ceva Logistics, and reports that hackers are also targeting financial firms and private equity giants.

Why it matters

As enterprise AI-data platforms accumulate more sensitive corporate information from hundreds of large customers, they become higher-value targets — and Alation’s vague public disclosure highlights how little affected customers typically learn in the early days of such an incident.