Cyber Security Cloud GitHub leak: one stolen login exposed customer data

What data may have leaked in the Cyber Security Cloud GitHub incident?

The data at risk includes company names, personal names and email addresses of some customers, plus communication-related information generated by using the services. The company is still working out exactly how much personal data is involved.

There is a catch. The logs only go back so far and don't record everything, so the company cannot see what happened across the whole period the credential was valid. That leaves gaps in the picture.

What has the company done about it?

It has disabled the leaked credential and checked and changed credentials for other services that were stored on GitHub. Related access rights have been reviewed, and the development machines involved were isolated and their accounts suspended. In-house security engineers and an outside specialist firm are running a forensic investigation.

Customers who may be affected will be told one by one. For personal data it handles on behalf of clients, the company will work with those clients to notify the people concerned.

So far it has found no unauthorised access or misuse of its own services as a result, and no secondary damage. The services and their security features are running as normal. The effect on earnings is still being assessed.

The company said that as a provider of security services it takes the matter seriously and will work on preventing a repeat and restoring trust.