Grafana Says Stolen GitHub Token Enabled Codebase Download and Extortion Attempt

Summary

Grafana says an unauthorized party used a stolen token to access its GitHub environment and download its codebase. It reports no customer data or system impact, invalidated the credentials, and refused an extortion demand; CoinbaseCartel attribution is unconfirmed.

Key points

Grafana says an unauthorized party used a stolen token to access its GitHub environment and download its codebase.
The company reports no customer data or personal information was accessed and no impact to customer systems or operations.
Grafana launched a forensic investigation, invalidated the compromised credentials, and added security measures.
The attacker attempted to extort Grafana; the company said it would not pay.
Grafana did not identify the incident date or confirm a threat actor. Hackmanac and Ransomware.live reported that CoinbaseCartel claimed responsibility.

Article Details

Victim Organization: Grafana
Incident Type: Unauthorized access to Grafana's GitHub environment using a stolen token, followed by codebase download and an extortion attempt.
Data Types Exposed: Grafana codebase
Operational Impact: Grafana reported no impact to customer data, customer systems, or operations. It launched a forensic investigation, invalidated the compromised credentials, and implemented additional security measures.
Ransom Or Extortion: The attacker demanded payment to prevent publication of the downloaded data. Grafana said it refused to pay.
Claim Status: confirmed

MITRE ATT&CK

T1213.003 · Code RepositoriesThe attacker accessed Grafana's GitHub environment and downloaded its codebase, consistent with obtaining information from a code repository.

Threat Actors

Coinbase CartelReports from Hackmanac and Ransomware.live say CoinbaseCartel claimed responsibility for the Grafana incident. Grafana did not attribute the breach to a known actor or group, so the group's responsibility remains unconfirmed.

Industries

TechnologyThe group, which only focuses on data theft and extortion, unlike traditional ransomware groups, has amassed 170 victims across healthcare, technology, transportation, manufacturing, and business services.