January 2023 Summaries

In early January 2023, CircleCI disclosed a security incident involving the compromise of a GitHub OAuth token and subsequent unauthorized access to some of its systems, affecting customer data. A malware attack on an employee's laptop enabled the theft of session cookies, allowing attackers to impersonate the employee and exfiltrate encrypted data and keys from production systems. In response, CircleCI conducted a thorough investigation with third-party specialists, rotated all potentially compromised tokens, and implemented additional security measures, such as enhanced monitoring and restricted access to production environments. Customers were advised to rotate their secrets and check for suspicious activity between mid-December 2022 and early January 2023. The company emphasized the importance of continuous security improvements and customer collaboration to prevent future incidents, committing to adopting more aggressive security practices and making advanced security features more accessible to customers.

In response to a security incident disclosed on January 4, 2023, CircleCI has taken multiple steps to mitigate potential risks and ensure the security of its platform. These measures include partnering with AWS to notify customers about potentially impacted tokens, rotating GitHub OAuth tokens, and revoking all personal and project API tokens created before January 5, 2023. CircleCI has also provided instructions for customers to rotate secrets and keys stored on their platform and has updated their tools to assist in discovering stored secrets. Despite the incident, CircleCI assures customers that they can continue to build and that no unauthorized access has occurred. The company emphasizes the importance of rotating access keys and secrets and offers support through its engineering and security teams, while also working closely with third-party investigators to validate their actions.