Grafana Labs Confirms GitHub Breach, Refuses Ransom Demand
Summary
Grafana Labs says an unauthorized party used a stolen token to access its GitHub environment and download its codebase. The company says no customer data or personal information was accessed and refused CoinbaseCartel’s ransom demand.
Key points
- Grafana Labs confirmed that an unauthorized party obtained a token for its GitHub environment and downloaded the company’s codebase.
- The company said its investigation found no customer data or personal information was accessed, and no evidence of impact to customer systems or operations.
- CoinbaseCartel claimed to have stolen information from Grafana Labs and sought a ransom to prevent the codebase’s release.
- Grafana Labs refused to pay and said the compromised credentials have been invalidated; its investigation is ongoing.
- The article describes CoinbaseCartel as linked to the Scattered Lapsus$ Hunters collective and says the group relies on stolen credentials and social engineering.
Article Details
- Victim Organization
- Grafana Labs
- Incident Type
- Unauthorized access to Grafana Labs’ GitHub environment using a stolen token, followed by codebase download and an extortion demand.
- Data Types Exposed
- Grafana Labs source code
- Operational Impact
- Grafana Labs reported no evidence of impact to customer systems or operations. It said no customer data or personal information was accessed.
- Ransom Or Extortion
- CoinbaseCartel claimed to have stolen information and demanded a ransom to prevent release of the codebase. Grafana Labs refused to pay. The source does not say whether the codebase was released.
- Claim Status
- confirmed
Threat Actors
Coinbase CartelIdentified in the article as an extortion group that claimed to have stolen information from Grafana Labs and demanded ransom. Grafana Labs confirmed the unauthorized access and codebase download, but the group’s claim of responsibility is not independently confirmed in the article.Scattered Lapsus$ HuntersThe article describes CoinbaseCartel as a data-theft offshoot linked to this cybercriminal collective. Halcyon reportedly said the group had attempted to extort more than 100 companies; the article does not establish that the collective itself carried out the Grafana Labs intrusion.