2026 Trigger.dev — attacker accessed environment variables for a subset of customer organizations; account owners emailed
Data compromised
Environment variables for the affected organizations, which can hold secrets and API keys. The company has not said which variables were read, how many organizations were affected, or whether any were used. No customer personal data is mentioned.
Technical writeup
The status page was read directly (incident dated November 1, 2026, 11:50pm CET). The Register report is secondary.
Root cause
Trigger.dev says it blocked the exploit used in the attack and found exposure across a subset of organizations. An attacker gained unauthorised access to those organizations' environment variables. It has emailed impacted account owners with steps to mitigate and says it will follow up. The exploit route has not been disclosed.