Grafana GitHub Token Compromise Codebase Download | MSSP Advisory

An unauthorized party compromised Grafana's GitHub environment using a stolen token, downloaded the company's source code, and attempted extortion. Grafana states no customer data was accessed and no evidence exists of impact to customer systems. The attack targeted GitHub repository access rather than production systems.

Your clients running Grafana instances face potential supply chain risk if attackers weaponize the stolen source code to find zero-days or backdoors. Your own monitoring stack is exposed if you run Grafana for client visibility because attackers now have the blueprint to target your dashboards and data sources.

📬