CircleCI breach exposed customer secrets after attackers hijacked an engineer’s SSO session

Attackers breached CircleCI after information-stealing malware infected an engineer’s laptop on December 16, 2022, and captured an authenticated SSO session cookie, allowing them to impersonate the employee despite two-factor authentication. The engineer’s privileges enabled the attackers to generate production access tokens and exfiltrate customer environment variables, tokens, and keys on December 22. Although the data was encrypted at rest, attackers also extracted encryption keys from a running process, potentially enabling decryption. CircleCI began investigating after a customer reported suspicious GitHub OAuth activity on December 29 and publicly disclosed the incident on January 4, 2023. Several customers subsequently reported unauthorized access to third-party systems. Datadog identified an affected legacy RPM signing key and passphrase but reported no evidence of leakage or misuse as of January 12.

CircleCI revoked and rotated credentials, rotated production hosts, restricted employee production access, introduced step-up authentication, and increased behavioral monitoring. It urged customers to rotate all secrets stored on the platform and investigate suspicious activity dating back to December 16. The incident exposed how stolen authenticated sessions and excessive developer privileges can turn an endpoint compromise into a software supply-chain risk. Credential rotation alone may not complete remediation: Wiz warned that attackers could use exposed cloud credentials to establish persistence in AWS, Azure, or Google Cloud. Affected organizations should review cloud audit logs, investigate unauthorized identities and role changes, inspect virtual machines, serverless functions, and automation for persistence, and assess potential data exfiltration.