Grafana Says TanStack-Linked Breach Hit GitHub Environment, With No Evidence of Production Compromise
Summary
Grafana Labs said its GitHub environment was breached through a TanStack npm supply-chain attack linked to TeamPCP. The company reported no evidence of production-system compromise and said it rotated tokens and strengthened GitHub security.
Key points
- Grafana said it detected the activity on May 11, 2026, and linked the breach to the TanStack npm supply-chain attack attributed to TeamPCP.
- The company said unauthorized access was limited to its GitHub environment, including public and private repositories and internal operational information.
- Grafana said it found no evidence that customer production systems or Grafana Cloud operations were compromised.
- A missed GitHub workflow token enabled repository access; Grafana said a workflow initially assessed as unaffected was later confirmed compromised.
- Grafana said it rotated automation tokens, enhanced monitoring, audited commits for malicious activity, and strengthened GitHub security controls.
- Grafana said it received an extortion demand from an unnamed actor on May 16 and refused to pay; separately, CoinbaseCartel listed the company on its site on May 15.
Article Details
- Victim Organization
- Grafana Labs
- Incident Type
- TanStack npm supply-chain attack leading to unauthorized access to Grafana Labs GitHub repositories and source code exposure
- Disclosure Date
- 2026-05-19
- Data Types Exposed
- Source code
- Internal operational information and other business details
- Business contact names and email addresses exchanged in professional relationships
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Unauthorized access was limited to Grafana Labs' public and private GitHub repositories. Grafana Labs said it found no evidence that customer production systems or Grafana Cloud operations were compromised. The company rotated automation tokens, enhanced monitoring, audited commits, and strengthened GitHub security controls.
- Ransom Or Extortion
- Grafana Labs said it received an extortion demand from an unnamed threat actor on 2026-05-16 and refused to pay. Separately, CoinbaseCartel listed Grafana Labs on its dark web site on 2026-05-15; the article does not establish that CoinbaseCartel was responsible for the breach or the demand.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Coinbase CartelThe article reports that this data extortion crew listed Grafana Labs on its dark web site on 2026-05-15; it does not establish that the crew caused the breach or sent the extortion demand.TeamPCPGrafana Labs attributed the breach to the TanStack npm supply-chain attack, which the article says was orchestrated by TeamPCP.
Products
GitHubGrafana Labs said its May 19, 2026 investigation found no evidence that customer production systems or Grafana Cloud operations were compromised, with the incident limited to its GitHub environment.Grafana CloudGrafana Labs said its May 19, 2026 investigation found no evidence that customer production systems or Grafana Cloud operations were compromised, with the incident limited to its GitHub environment.