Enterprise communication and collaboration platform Slack has informed customers that hackers have stolen some of its private source code repositories, but claims impact is limited.

Slack disclosed the incident on December 31. It’s not uncommon for companies to disclose data breaches right before or during major holidays in hopes that they will not get too much attention.

On the other hand, Slack said it learned of the suspicious activity on December 29 so it may have just wanted to inform customers about the incident as soon as possible.

The investigation showed that the attackers downloaded private code repositories on December 27. The hackers apparently gained access to the company’s externally hosted GitHub repository using stolen employee tokens. The company said a “limited number” of employees were impacted.

The compromised repositories did not contain customer data or information that could be used to access customer data. They also did not contain Slack’s primary codebase, the company said.

“Our current findings show that the threat actor did not access other areas of Slack’s environment, including the production environment, and they did not access other Slack resources or customer data. There was no impact to our code or services, and we have also rotated all relevant credentials as a precaution,” Slack explained.

It added, “Based on currently available information, the unauthorized access did not result from a vulnerability inherent to Slack. We will continue to investigate and monitor for further exposure.”

Slack’s disclosure came roughly one week after identity and access management solutions provider Okta informed customers that some source code was stolen from its GitHub repositories. It’s unclear if the incidents are related.

There have been several security incidents involving source code this year. In April, GitHub revealed that the private repositories of dozens of organizations were downloaded using stolen OAuth tokens issued to Heroku and Travis CI. GitHub said that attack was highly targeted.

By Eduard Kovacs on Thu, 05 Jan 2023 11:42:25 +0000
Original link