Enterprise communication and collaboration platform Slack has informed customers that hackers have stolen some of its private source code repositories, but claims impact is limited.
Slack disclosed the incident on December 31. It’s not uncommon for companies to disclose data breaches right before or during major holidays in hopes that they will not get too much attention.
On the other hand, Slack said it learned of the suspicious activity on December 29 so it may have just wanted to inform customers about the incident as soon as possible.
The investigation showed that the attackers downloaded private code repositories on December 27. The hackers apparently gained access to the company’s externally hosted GitHub repository using stolen employee tokens. The company said a “limited number” of employees were impacted.
The compromised repositories did not contain customer data or information that could be used to access customer data. They also did not contain Slack’s primary codebase, the company said.
“Our current findings show that the threat actor did not access other areas of Slack’s environment, including the production environment, and they did not access other Slack resources or customer data. There was no impact to our code or services, and we have also rotated all relevant credentials as a precaution,” Slack explained.
It added, “Based on currently available information, the unauthorized access did not result from a vulnerability inherent to Slack. We will continue to investigate and monitor for further exposure.”
Slack’s disclosure came roughly one week after identity and access management solutions provider Okta informed customers that some source code was stolen from its GitHub repositories. It’s unclear if the incidents are related.
There have been several security incidents involving source code this year. In April, GitHub revealed that the private repositories of dozens of organizations were downloaded using stolen OAuth tokens issued to Heroku and Travis CI. GitHub said that attack was highly targeted.
Related: Slack Forces Password Resets After Discovering Software Flaw
Related: GitHub Account Renaming Could Have Led to Supply Chain Attacks
Related: GitHub Announces Free Secret Scanning, Mandatory 2FA
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Siemens License Manager Vulnerabilities Allow ICS Hacking
- CISA Releases Open Source Recovery Tool for ESXiArgs Ransomware
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
Latest News
- Minister: Cybercrimes Now 20% of Spain’s Registered Offenses
- Skybox Security Raises $50M, Hires New CEO
- Spies, Hackers, Informants: How China Snoops on the US
- Australian Man Sentenced for Scam Related to Optus Hack
- Chrome 110 Patches 15 Vulnerabilities
- Application Security Protection for the Masses
- Tor Network Under DDoS Pressure for 7 Months
- Siemens License Manager Vulnerabilities Allow ICS Hacking
