It turns out that a private code repository was stolen from Slack's GitHub account
In the chat tool Slack, it was found that someone had downloaded a private code repository stored on GitHub. It is said that customer data is not included, and Slack is immediately taking measures such as invalidating the tokens used for theft.
Slack security updates | Slack
Slack's private GitHub code repositories stolen over holidays
According to Slack, suspicious behavior was found in the GitHub account on December 29, 2022. As a result of investigation, it was found that the employee's token was being used to access the GitHub repository without permission. The attacker had downloaded a private code repository on December 27, 2022.
The code repository is a library of software code and contains documents and notes in addition to the code itself, but it seems that the downloaded repository did not contain customer data.
Slack will immediately deactivate the token. The attacker did not access the Slack environment, including the production environment, and did not affect any code or services.
News site Bleeping Computer is trying to hide it from search engines because the official Slack blog post announcing the matter is not displayed on the article list page and has a 'noindex' tag inserted. I pointed out that it was, but it was resolved at the time of article creation (link to the article in the red frame part of the image below). It is unknown whether Slack did not display it intentionally or it was just delayed.
News | Slack
https://slack.com/intl/en-gb/blog/news
Related Posts:
in Web Service, Security, Posted by logc_nt