Grafana Labs Breach Exposes GitHub Repositories and Codebase

A sophisticated attacker exploited a misconfigured GitHub Actions pull_request_target workflow at Grafana Labs by injecting a malicious curl in a forked repository, stealing a privileged token to download the company’s private codebase and demanding ransom; Grafana detected the breach via a triggered canary token, prevented further access, removed the vulnerable workflow, invalidated credentials, and reported no customer data was accessed.