Secrets

Security incidents tagged Secrets. Newest first.

0 Secrets incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 5 older incidents

May 31HighHugging Face Spaces secrets accessed without authorizationNo fix needed
Hugging Face Spaces No fix needed
Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.
Open incident →

Nov 14HighCloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breachNo fix needed
Cloudflare internal Atlassian environment No fix needed
A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.
Open incident →

Jun 22HighMicrosoft AI researchers exposed 38TB via an over-permissive Azure SAS linkPatched
Microsoft Azure Storage (SAS token in a GitHub repo) Patched
A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.
Open incident →

Mar 24MediumGitHub's RSA SSH host key briefly exposed in a public repoPatched
GitHub (github.com SSH) Patched
GitHub's private RSA SSH host key for github.com was briefly exposed in a public repository. GitHub rotated it as a precaution, which meant anyone connecting over SSH with RSA saw a host key mismatch warning until they updated known_hosts.
Open incident →

CriticalNo fix needed
CircleCI breach: rotate every secret
Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.
CircleCIClosed Jan 13, 2023updated Jan 13, 2023