Grafana Says TanStack Supply-Chain Attack Led to Theft of Code and Internal Data
Summary
Grafana says an unrevoked GitHub workflow token let attackers access its repositories after the TanStack supply-chain attack. They stole code and internal business information, but Grafana reports no impact to customer production systems or Grafana Cloud.
Key points
- Grafana says it detected malicious activity on May 11 and rotated GitHub workflow tokens, but one token was not revoked.
- The attackers used the remaining token to access Grafana Labs GitHub repositories.
- Grafana says the stolen material included public and private source code, internal operational information, and business details, including professional contact names and email addresses.
- Grafana received a ransom demand on May 16 and refused to pay; it also hardened its GitHub posture and notified law enforcement.
- Grafana says customer production systems and Grafana Cloud were not affected, the codebase was not modified, and customers and open-source users need take no action.
Article Details
- Victim Organization
- Grafana Labs
- Incident Type
- Supply-chain attack leading to unauthorized access to GitHub repositories and theft of source code and internal business information
- Data Types Exposed
- Source code
- Internal operational information
- Business details
- Business contact names and email addresses
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Grafana Labs said no customer production systems, operations, or the Grafana Cloud platform were affected. The codebase was downloaded but not modified.
- Ransom Or Extortion
- Grafana Labs said it received a ransom demand on May 16 and refused to pay. The demand amount and terms were not disclosed.
- Claim Status
- confirmed
MITRE ATT&CK
Malware
Products
GitHubGrafana this week revealed that the unauthorized access to the Grafana Labs GitHub repositories disclosed earlier this month was the result of the TanStack supply chain attack.npmOn May 11, TanStack and other high-profile NPM and PyPI projects were hit by a Mini Shai-Hulud supply chain attack that resulted in self-propagating information-stealing malware being deployed on victims’ computers.PyPIOn May 11, TanStack and other high-profile NPM and PyPI projects were hit by a Mini Shai-Hulud supply chain attack that resulted in self-propagating information-stealing malware being deployed on victims’ computers.