Documented incidentDisclosed 2023-01-04CircleCIEngineering postmortem

Malware steals an engineer's SSO session and exposes CircleCI customer secrets (2023)

Malware on an engineer's laptop stole a valid two-factor-backed SSO session, letting the attacker impersonate the employee and reach a subset of production systems.

What happened

  • The attacker exfiltrated customer environment variables, tokens and keys; although data was encrypted at rest, they extracted encryption keys from a running process.CircleCI incident report for January 4, 2023 security incident

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Harden employee endpoints and sessionsUse device posture checks, endpoint detection and short, device-bound sessions so stolen cookies cannot be replayed.
  • Limit production token privileges and protect encryption keysAvoid employees who can mint broad production tokens by default, and keep encryption keys out of extractable process memory.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern