Grafana GitHub Token Breach Results in Codebase Theft and Extortion Plot

May 17
2 min read

Key Findings

Unauthorized party obtained a GitHub token granting access to Grafana's environment and downloaded company source code
Attacker demanded ransom to prevent stolen code from being published; Grafana refused to pay
No customer data, personal information, or impact to customer systems was identified
CoinbaseCartel, a data extortion group that emerged in September 2025, has claimed responsibility
Grafana invalidated compromised credentials and implemented additional security measures following discovery
Timing and specifics of initial compromise remain undisclosed

Background

Grafana is an open-source observability platform provider offering cloud-hosted solutions for monitoring applications and infrastructure. The company discovered recently that an attacker had gained unauthorized access to its GitHub environment through a compromised token. Upon detection, Grafana launched an immediate forensic investigation to determine the scope of the breach and identify how the compromise occurred.

The Breach Details

The threat actor used the stolen GitHub token to access Grafana's repository environment and download portions of the company's codebase. While Grafana has not specified which codebases were accessed or how much material was stolen, the company confirmed that the attacker obtained enough sensitive material to use as leverage for extortion purposes. The specifics about when the token was originally compromised and how long the attacker maintained access remain unclear.

Extortion Attempt and Response

Following the codebase theft, the attacker contacted Grafana with ransom demands, threatening to publish the stolen source code if payment was not made. Grafana declined to negotiate or pay, citing guidance from the FBI that warns against ransoms. The FBI maintains that paying ransoms encourages further attacks, provides no guarantee of data recovery, and incentivizes criminal activity in the industry.

Attribution and Threat Actor Profile

Security researchers at Hackmanac and Ransomware.live attribute the incident to CoinbaseCartel, a data extortion group that emerged in late 2025. According to Halcyon and Fortinet FortiGuard Labs, CoinbaseCartel focuses exclusively on data theft and extortion rather than deploying traditional ransomware. The group is assessed as an offshoot of known cybercriminal ecosystems including ShinyHunters, Scattered Spider, and LAPSUS$. CoinbaseCartel has accumulated approximately 170 confirmed victims across healthcare, technology, transportation, manufacturing, and business services sectors.

Remediation Actions

Grafana immediately invalidated the compromised GitHub token and conducted a comprehensive forensic analysis. The company has implemented additional security measures to prevent unauthorized access to its environment going forward. No evidence emerged suggesting the attacker accessed customer data or impacted operational systems during the incident.

Sources

https://thehackernews.com/2026/05/grafana-github-token-breach-led-to.html
https://ground.news/article/grafana-github-token-breach-led-to-codebase-download-and-extortion-attempt_3516c9
https://www.youtube.com/watch?v=AAJ3FnNG8pA