Grafana source‑code theft after stolen GitHub token and supply‑chain breach

Grafana Labs, the maker of the popular open‑source monitoring platform used by more than 7,000 organisations—including 70 % of the Fortune 50—has confirmed that hackers stole a GitHub workflow token and used it to download the company’s private source code. The breach was claimed by the extortion gang CoinbaseCartel, which added Grafana to its data‑leak site (DLS) but has not yet released any of the exfiltrated files. The attackers gained the token through a supply‑chain compromise involving the TanStack npm package, which contained an info‑stealer module that siphoned GitHub workflow tokens to the gang’s infrastructure. Although Grafana’s security team immediately rotated many tokens, one slipped through the rotation process, allowing the attackers to access private repositories.

The incident also involved the exfiltration of more than 3,800 internal repositories, though no customer data or personal information was compromised. No code modifications were made to Grafana’s production code, and the company confirmed that its customer systems remained unaffected. In response, Grafana invalidated the compromised credentials, added multi‑factor authentication, and tightened its token‑rotation procedures. The company chose not to pay the ransom, following FBI guidance, and pledged to release further details once its post‑incident investigation is complete.

CoinbaseCartel, active since last September, is known for using phishing, social engineering, and in‑memory tools such as “shinysp1d3r” to encrypt VMware ESXi targets. The gang has listed over 100 victims on its DLS and is notorious for targeting open‑source projects. The Grafana breach underscores the importance of securing repository access, monitoring for credential misuse, and enforcing rigorous token‑rotation policies after supply‑chain incidents. It also highlights the growing threat that open‑source ecosystems face from sophisticated extortion groups that combine credential theft with ransomware tactics.