Apple: Employee computers were targeted in hack attack

Apple today said it too was targeted as part of the string of hacking efforts on companies and news agencies.

The iPhone and Mac maker told Reuters that hackers targeted computers used by its employees, but that "there was no evidence that any data left Apple."

In a statement, Apple said it discovered malware that made use of a vulnerability in the Java plug-in, and that it was sourced from a site for software developers:

Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers. The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers. We identified a small number of systems within Apple that were infected and isolated them from our network. There is no evidence that any data left Apple. We are working closely with law enforcement to find the source of the malware.

Since OS X Lion, Macs have shipped without Java installed, and as an added security measure OS X automatically disables Java if it has been unused for 35 days. To protect Mac users that have installed Java, today we are releasing an updated Java malware removal tool that will check Mac systems and remove this malware if found.

Apple blocked Java from some of its Macs late last month using its XProtect antimalware tool and citing security vulnerabilities.

Reuters says Apple plans to release a security update later today to protect users' computers.

Apple joins a list of companies including Facebook, The New York Times, The Wall Street Journal, and The Washington Post, as targets of a group of hackers believed to originate from China.

A report Monday by The New York Times claimed that an "overwhelming percentage" of the cyberattacks on U.S. corporations, government agencies, and organizations all came from an office building in Shanghai with ties to the People's Liberation Army, information that remains unconfirmed and flatly denied by Chinese authorities.

The hack itself was months long, and the attack on The New York Times included the theft of corporate passwords of Times employees, as well as spying on personal computers. Apple says only "a small number of systems" were infected by the attack before being isolated.

Update at 1:54 p.m. PT: According to reports from The New York Times and All Things Digital, one of the sites still infected -- and believed to be a potential source for the malware used in the attack -- was iPhonedevsdk, a forums site that CNET is not linking to and encourages readers NOT to visit.

Previously updated at 11 a.m. PT added comment from Apple.