“Current findings indicate the scope of this incident is limited to the Grafana Labs GitHub repositories, which include public and private source code along with internal GitHub repos,” Grafana says.While no customer production systems or operations were affected, the hackers did steal Grafana’s codebase, as well as repositories storing internal operational information and other business details.“This includes business contact names and email addresses that would be exchanged in a professional relationship context, not information pulled from or processed through the use of production systems or the Grafana Cloud platform,” Grafana says.The incident, it explains, did not affect its production systems, nor the Grafana Cloud platform. Furthermore, Grafana says, while its codebase was downloaded, it was not modified, and no action is needed from customers or open source users.Related:Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little VisibilityRelated:AI-Powered App Attacks Are Faster, More Frequent and Harder to StopRelated:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

While no customer production systems or operations were affected, the hackers did steal Grafana’s codebase, as well as repositories storing internal operational information and other business details.“This includes business contact names and email addresses that would be exchanged in a professional relationship context, not information pulled from or processed through the use of production systems or the Grafana Cloud platform,” Grafana says.The incident, it explains, did not affect its production systems, nor the Grafana Cloud platform. Furthermore, Grafana says, while its codebase was downloaded, it was not modified, and no action is needed from customers or open source users.Related:Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little VisibilityRelated:AI-Powered App Attacks Are Faster, More Frequent and Harder to StopRelated:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

“This includes business contact names and email addresses that would be exchanged in a professional relationship context, not information pulled from or processed through the use of production systems or the Grafana Cloud platform,” Grafana says.The incident, it explains, did not affect its production systems, nor the Grafana Cloud platform. Furthermore, Grafana says, while its codebase was downloaded, it was not modified, and no action is needed from customers or open source users.Related:Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little VisibilityRelated:AI-Powered App Attacks Are Faster, More Frequent and Harder to StopRelated:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

The incident, it explains, did not affect its production systems, nor the Grafana Cloud platform. Furthermore, Grafana says, while its codebase was downloaded, it was not modified, and no action is needed from customers or open source users.Related:Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little VisibilityRelated:AI-Powered App Attacks Are Faster, More Frequent and Harder to StopRelated:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

Related:Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little VisibilityRelated:AI-Powered App Attacks Are Faster, More Frequent and Harder to StopRelated:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

Related:AI-Powered App Attacks Are Faster, More Frequent and Harder to StopRelated:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

Related:Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain AttackRelated:OpenAI Hit by TanStack Supply Chain Attack

Related:OpenAI Hit by TanStack Supply Chain Attack

Ionut Arghire is an international correspondent for SecurityWeek.

Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization.

Source: SecurityWeek