Slack

Summary

Slack experienced unauthorized access to a subset of its private GitHub code repositories after threat actors stole and misused employee tokens obtained via a compromised third-party vendor. The attackers downloaded certain repositories, but the company confirmed no customer data, access mechanisms, or primary codebase were exposed. Immediate response included token invalidation, credential rotation, and an investigation which found no impact to production environments or customer resources. Enhanced monitoring was implemented for external repositories, with no inherent platform vulnerabilities identified as the cause.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Slack experienced a security incident in late December 2022 involving unauthorized access to portions of its code repositories hosted externally on GitHub. The company detected suspicious activity on its GitHub account on December 29, 2022, following a notification about potential compromise. Investigation revealed threat actors had stolen a limited number of Slack employee tokens and used them to download private code repositories on December 27. The accessed repositories did not contain Slack's primary codebase, customer data, or mechanisms to access customer information. Slack immediately invalidated the compromised tokens upon discovery and initiated an impact assessment. The company confirmed the breach did not extend to its production environment, other Slack resources, or customer-facing systems. No modifications were made to Slack's code or services during the incident, and the platform maintained normal operations throughout.

Slack's investigation determined the token theft originated from a compromised third-party vendor rather than an inherent vulnerability in Slack's infrastructure. As a precautionary measure, the company rotated all relevant credentials and collaborated with the affected vendor to secure authentication processes. Forensic analysis confirmed the threat actor's access was confined exclusively to the GitHub repositories and did not involve other areas of Slack's environment. The company implemented enhanced monitoring for its GitHub repositories and reviewed token storage practices with security partners. Slack publicly disclosed the incident through a security update, emphasizing no customer action was required due to the absence of data exposure. The breach resolution included continuous monitoring for potential secondary exposures while maintaining standard service delivery.

Sources

Sources available to members: 2 sources.