CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Grafana GitHub token compromise leads to codebase exfiltration and extortion attempt

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

An unauthorized actor obtained a GitHub token granting access to Grafana’s codebase environment, leading to the exfiltration of proprietary source code. Grafana confirmed no customer data or operational systems were affected and that forensic analysis traced the leak to compromised credentials, which were revoked and supplemented with additional security controls. The attacker attempted extortion by demanding payment to prevent publication of the stolen materials, but Grafana declined to pay and reported the incident to law enforcement.

Timeline

  1. 17.05.2026 10:13 1 articles · 2h ago

    Grafana GitHub token breach and extortion attempt disclosed

    Unauthorized access to Grafana’s GitHub environment via a compromised token resulted in the exfiltration of proprietary code. The company reported no customer data or operational impact, revoked compromised credentials, and implemented additional security measures. An extortion attempt by the threat actor was rebuffed, with Grafana citing FBI guidance. The incident was allegedly claimed by CoinbaseCartel, a data extortion crew linked to ShinyHunters and other high-profile intrusion groups.

    Show sources
    Open in new tab

Information Snippets