ClosedCriticalNo fix needed

CircleCI breach: rotate every secret

CircleCI

Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.

Why this severity: CI/CD platform breach exposing customer secrets

Started: Jan 4, 2023
Closed: Jan 13, 2023

Updated Jan 13, 2023

Affected

Not published yet

Fixed in

No fixed release yet

Timeline2

Jan 13, 2023
Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated
Source
Jan 4, 2023
CircleCI tells all customers to rotate every secret stored in CircleCI
Source

Advisories2

Notes & caveats

The initial compromise (Dec 16, 2022) and exfiltration (Dec 22, 2022) predate startedAt, which is the public alert.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified