Another day, another supply chain attack. This time it is cybersecurity firm CrowdSec who just go pwned:
The company provides open source, crowdsourced threat intelligence, including a lightweight security engine to detect and block attacks targeting servers, networks, and applications.
Last week, the French outfit learned that source code had been stolen from its GitHub repositories in May 2026.
CrowdSec has confirmed the report, noting that both private and public code was exfiltrated, and that roughly 300 repositories were affected, including approximately 170 private ones.
“The private part contains the source code for our SaaS console, some AWS Cloud routines, some connectors, and automations,” the company said.
According to CrowdSec, no credentials or other types of data related to its customers were leaked, and the impact is limited to its own organization.
John Strand, Owner, BHIS (https://www.linkedin.com/in/john-strand-a1b4b62)
“A couple of things about this are really concerning. First, when we’re talking about a company like CrowdSec, we’re talking about an organization that is relatively security-aware. So the obvious question is how many other companies have been compromised that don’t have that same level of security rigor?
“The other concern with these NPM attacks attributed to Team PCP is that we tend to immediately ask what was exfiltrated. What did the attackers steal? Did they get credentials? Those are still important questions, but I think we increasingly need to ask the opposite question as well. What did the attackers put in?
“Did they modify source code? Did they alter data? Did they poison packages or introduce something that could persist downstream?
“In software supply chain attacks, understanding what was stolen is important. Understanding what may have been changed or planted is becoming just as important.”
Denis Calderone, Co-founder & COO, Suzu Labs (https://www.linkedin.com/in/deniscalderone)
“Revoking access the moment someone leaves is about as fundamental as security gets. It’s day-one stuff. CrowdSec didn’t do it. They kept a departed employee’s GitHub access open so he could wrap up some outstanding work, and that lingering account is what attackers used to clone 170 private repositories.
“CrowdSec’s reassurance is that the code is old, it’s changed a lot in four months, and they’ve found nothing that enables lateral movement. Maybe that’s mostly true, but source code is a complex target. It’s a map of your environment, hardcoded secrets, internal endpoints, connector logic, the architecture of the SaaS console itself. Their own analysis turned up a live AWS credential in the leaked code, and the attacker tested it in August. It didn’t lead anywhere this time, but a working key was still sitting in code they’d called harmless. The first statement said nothing leaked. A day later that was 83 user emails and the names and investment details of 51 investors.
“When someone leaves, their access leaves with them that day, no exceptions for wrapping up loose ends. Scope tokens tight and give them short lifetimes, so a stolen one is useless in a week instead of months. Put EDR on any workstation that touches code or infrastructure, because that developer laptop is part of your attack surface now. And treat your own source code as sensitive data. Scan it for hardcoded secrets before an attacker does, and assume anything ever committed to it is one bad day from being public.
Ask yourself, if a valid credential walked off with your entire codebase tomorrow, would you find out from your own logs, or from a breach forum four months later?
A security firm should not have gotten pwned. Ever. Face it, this is as bad as it gets. And frankly speaking, you should be looking elsewhere for your security needs.
Related
This entry was posted on September 22, 2026 at 8:17 am and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
CrowdSec pwned in supply chain attack
Another day, another supply chain attack. This time it is cybersecurity firm CrowdSec who just go pwned:
The company provides open source, crowdsourced threat intelligence, including a lightweight security engine to detect and block attacks targeting servers, networks, and applications.
Last week, the French outfit learned that source code had been stolen from its GitHub repositories in May 2026.
CrowdSec has confirmed the report, noting that both private and public code was exfiltrated, and that roughly 300 repositories were affected, including approximately 170 private ones.
“The private part contains the source code for our SaaS console, some AWS Cloud routines, some connectors, and automations,” the company said.
According to CrowdSec, no credentials or other types of data related to its customers were leaked, and the impact is limited to its own organization.
John Strand, Owner, BHIS (https://www.linkedin.com/in/john-strand-a1b4b62)
“A couple of things about this are really concerning. First, when we’re talking about a company like CrowdSec, we’re talking about an organization that is relatively security-aware. So the obvious question is how many other companies have been compromised that don’t have that same level of security rigor?
“The other concern with these NPM attacks attributed to Team PCP is that we tend to immediately ask what was exfiltrated. What did the attackers steal? Did they get credentials? Those are still important questions, but I think we increasingly need to ask the opposite question as well. What did the attackers put in?
“Did they modify source code? Did they alter data? Did they poison packages or introduce something that could persist downstream?
“In software supply chain attacks, understanding what was stolen is important. Understanding what may have been changed or planted is becoming just as important.”
Denis Calderone, Co-founder & COO, Suzu Labs (https://www.linkedin.com/in/deniscalderone)
“Revoking access the moment someone leaves is about as fundamental as security gets. It’s day-one stuff. CrowdSec didn’t do it. They kept a departed employee’s GitHub access open so he could wrap up some outstanding work, and that lingering account is what attackers used to clone 170 private repositories.
“CrowdSec’s reassurance is that the code is old, it’s changed a lot in four months, and they’ve found nothing that enables lateral movement. Maybe that’s mostly true, but source code is a complex target. It’s a map of your environment, hardcoded secrets, internal endpoints, connector logic, the architecture of the SaaS console itself. Their own analysis turned up a live AWS credential in the leaked code, and the attacker tested it in August. It didn’t lead anywhere this time, but a working key was still sitting in code they’d called harmless. The first statement said nothing leaked. A day later that was 83 user emails and the names and investment details of 51 investors.
“When someone leaves, their access leaves with them that day, no exceptions for wrapping up loose ends. Scope tokens tight and give them short lifetimes, so a stolen one is useless in a week instead of months. Put EDR on any workstation that touches code or infrastructure, because that developer laptop is part of your attack surface now. And treat your own source code as sensitive data. Scan it for hardcoded secrets before an attacker does, and assume anything ever committed to it is one bad day from being public.
Ask yourself, if a valid credential walked off with your entire codebase tomorrow, would you find out from your own logs, or from a breach forum four months later?
A security firm should not have gotten pwned. Ever. Face it, this is as bad as it gets. And frankly speaking, you should be looking elsewhere for your security needs.
Share this:
Like this:
Related
This entry was posted on September 22, 2026 at 8:17 am and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.