2026 Grafana Labs — GitHub token compromise; codebase downloaded; Coinbase Cartel extortion (May)
Data compromised
Grafana Labs source code repositories; no attested customer PII or Grafana Cloud tenant content per company statements
Technical writeup
Grafana Labs confirmed in mid-May 2026 that an unauthorized party obtained a token granting access to its GitHub environment and downloaded Grafana’s source code. The company said forensic review found no customer data or personal information accessed and no evidence of impact to customer systems or operations; compromised credentials were invalidated and additional controls were applied. Grafana publicly refused a ransom demand tied to threats to leak the codebase, citing FBI guidance against paying extortionists. SecurityWeek and The Hacker News reported the Coinbase Cartel extortion brand—linked in industry analysis to ShinyHunters / Scattered Spider / LAPSUS$–adjacent activity—listed Grafana on a leak site around May 15 before Grafana’s Sunday confirmation. This row tracks corporate-source-code theft rather than a Grafana Cloud customer database leak.
Root cause
Compromised GitHub access token enabling repository/codebase download (extortion-focused intrusion)
References
- https://thehackernews.com/2026/05/grafana-github-token-breach-led-to.html
- https://www.securityweek.com/grafana-confirms-breach-after-hackers-claim-they-stole-data/
- https://x.com/grafana/status/2055827123236171827
- https://grafana.com/blog/grafana-security-update-no-customer-impact-from-github-workflow-vulnerability/