Jan 4, 2023

Started

• ClosedCritical–No fix needed

  CircleCI breach: rotate every secret

  Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.

  CircleCI·Closed Jan 13, 2023·updated Jan 13, 2023