Grafana Says Stolen GitHub Token Enabled Source Code Theft
Summary
Grafana Labs said attackers used a stolen access token to breach its GitHub environment and download source code. It found no evidence of customer data exposure, refused an extortion demand and is continuing its investigation.
Key points
- Grafana Labs said attackers used a stolen access token to access its GitHub environment and download source code.
- The company said its investigation found no evidence that customer data or personal information was exposed, and that customer systems were unaffected.
- Grafana invalidated the compromised credentials and implemented additional security measures.
- CoinbaseCartel claimed responsibility and listed Grafana on its leak site; the group reportedly demanded payment to prevent publication of the stolen code.
- Grafana said it would not pay and would provide more details after its post-incident investigation.
- Researchers described CoinbaseCartel as linked to ShinyHunters and Lapsus$ affiliates, but ShinyHunters denied a connection to the group or its ransomware operation.
Article Details
- Victim Organization
- Grafana Labs
- Incident Type
- Unauthorized access to Grafana Labs' GitHub environment using a stolen access token, followed by source code download and an extortion demand.
- Data Types Exposed
- Grafana Labs source code
- Operational Impact
- Hackers downloaded source code. Grafana Labs reported no evidence that customer data or personal information was exposed and said customer systems were unaffected. The company invalidated compromised credentials and added security measures.
- Ransom Or Extortion
- The attacker demanded payment in exchange for not publishing the stolen source code. Grafana Labs refused to pay. CoinbaseCartel listed Grafana on its leak site, but the article reported that no data had been leaked there at publication time.
- Claim Status
- confirmed
MITRE ATT&CK
People
Threat Actors
Coinbase CartelClaimed responsibility for the Grafana Labs attack and listed Grafana on its data leak site. Grafana Labs confirmed the source-code theft, but the article does not independently confirm the group's responsibility. ShinyHunters later denied that CoinbaseCartel is linked to its group or ransomware operation.LAPSUS$Multiple researchers reportedly described CoinbaseCartel as consisting in part of Lapsus$ affiliates; the article does not establish that Lapsus$ itself was involved in the Grafana Labs incident.ShinyHuntersIdentified in the article as an extortion group that developed the ShinySp1d3r Windows encryptor. Researchers reportedly described CoinbaseCartel as consisting of ShinyHunters and Lapsus$ affiliates, but ShinyHunters denied that CoinbaseCartel is linked to its group or ransomware operation.
Malware
Vendors
Products
GitHubGrafana Labs said hackers downloaded its source code after compromising its GitHub environment with a stolen access token, but no customer data or personal information was exposed.GrafanaGrafana Labs said hackers downloaded its source code after compromising its GitHub environment with a stolen access token, but no customer data or personal information was exposed.