CI/CD service CircleCI says it is investigating “a security incident” and “out of an abundance of caution” all customers should “rotate any and all secrets”
CircleCI, a software development service has disclosed a security incident and is urging users to rotate their secrets.
BleepingComputer Ax Sharma
Related Coverage
- CircleCI warns customers to rotate ‘any and all secrets’ after hack TechCrunch · Carly Page
- CircleCI security alert: Rotate any secrets stored in CircleCI CircleCI · Rob Zuber
- Data Breach: CircleCI Says Immediately ‘Rotate Your Secrets’ GovInfoSecurity.com · Mathew J. Schwartz
- CircleCI was compromised over the holidays. I've been investigating the use of a @ThinkstCanary@mastodon.sdf.org AWS token that was improperly accessed on December 27th and suspected as much. Now we have confirmation from the vendor. @sanitybit@infosec.exchange · Daniel Hückmann
- CircleCi is reporting a “security incident,” but the wording used and and actions advised suggests it's probably a full blown breach: https://circleci.com/... “At this point, we are confident … @dangoodin@infosec.exchange · Dan Goodin
- CircleCI, a software development service has disclosed a security incident and is urging users to rotate their secrets. The CI/CD platform touts having a user base comprising more than one million engineers who rely on the service for … @BleepingComputer@infosec.exchange
Discussion
-
@campuscodi@mastodon.social
Catalin Cimpanu
on mastodon
CircleCI just disclosed a major security breach. Like major-major. I'll be adding an update to the web version of the newsletter shortly. https://circleci.com/...
-
@ax_sharma
Ax Sharma
on x
CircleCI discloses security incident: Ironically, the wording suggests that CircleCI was breached on December 21st—the same day it published a “reliability update” reinforcing its commitment to bettering its services. https://www.bleepingcomputer.com/ ... #databreach
-
@magoo
Ryan McGeehan
on x
Circle CI compromised. Yes, it's exactly like the tabletop scenario. Rotate secrets immediately. https://twitter.com/...
-
@circleci
@circleci
on x
CircleCI Security Alert [4 Jan. 2023] We strongly recommend all CircleCI customers rotate secrets stored on our system. Read more: https://circleci.com/... https://twitter.com/...
-
@chanjbs
Jason Chan
on x
Goodness - dev infra (e.g. Circle, Travis) and identity infra (e.g. Okta, LastPass) is critical infrastructure. These organizations really need to start operating as such if they want to be in these markets. https://twitter.com/...