Cybersecurity firm Trellix — formed from the 2022 merger of McAfee Enterprise and FireEye — has confirmed that an attacker accessed part of its source code repository. The breach was disclosed on 1 May, and on 7 May the ransomware crew RansomHouse claimed responsibility by listing the company on its leak site, as reported by The Hacker News. Trellix says there’s no evidence its source code release process was compromised, but the investigation is ongoing.

Why this matters for Australian not-for-profits: a lot of mid-sized NFPs run Trellix endpoint protection, either as their primary anti-malware tool or alongside Microsoft Defender for Endpoint. Even if you don’t, the bigger lesson is the same. When a security vendor itself is the victim, the obvious question becomes uncomfortable — what happens if the tool you trust to defend you is being studied by the people you’re defending against?

NFPs are especially exposed here because the average not-for-profit security stack is thinner and more centralised than a corporate one. One compromised vendor can affect the whole organisation’s posture in a way a redundancy-heavy enterprise wouldn’t notice. Tight budgets also mean fewer compensating controls when something does go wrong.

What to do this week:

• List the security and IT vendors you actually depend on. If you can’t name them in five minutes, that’s your first problem to fix — not the breach.
• Check whether any of those vendors have issued a breach notification in the last 90 days. The OAIC’s notifiable data breaches page is a useful cross-reference.
• For Trellix specifically: confirm your endpoint version is current and your signature feeds are pulling fresh updates. Don’t disable anything based on the breach — just verify the basics are working.
• Ask your IT partner how they monitor vendor incident reports on your behalf. This shouldn’t be your job to track.

This isn’t a panic story. It’s a supply-chain hygiene story. All IT Services works with Australian NFPs on exactly this kind of layered security — so a single vendor incident doesn’t turn into your incident.