JetBrains Cadence Compromised via Exploitation of TeamCity Vulnerability (Incident)

**Executive summary:** Threat actors exploited an unpatched JetBrains TeamCity vulnerability (CVE-2026-63077) used by Cadence to gain access beginning August 8; JetBrains discovered the activity on August 23 and took the server offline on August 24. The attackers exfiltrated personal data (usernames, real names, emails, last-login timestamps, last-access IPs) and a 2024 Cadence backup containing credentials, configuration, artifacts, logs, and AWS IAM credentials that could permit access to S3 buckets and potentially synchronized source code; JetBrains advises treating credentials or secrets in that backup or Cadence executions as compromised.