Check Point confirms breach, but says it was 'old' data and crook made 'false' claims

A threat actor using the handle CoreInjection posted on a cybercrime forum claiming to have stolen "highly sensitive" Check Point data, including admin-portal screenshots suggesting access to account lists, credentials and proprietary source code; Check Point counters that the event was a previously handled, narrow incident from December 2024 affecting only three organisations via a portal account with limited access and that the forum claims are exaggerated, while industry observers noted the screenshots appeared convincing but the true scope remains unclear.