Grafana confirmed struggling a data breach on Sunday, two days after a cybercrime group listed the corporate on its leak web site.
The open supply visualization and analytics software program supplier stated the intrusion was potential resulting from a compromised token that granted entry to the Grafana Labs GitHub atmosphere.
Grafana admitted that the hackers managed to obtain its codebase, however stated no private or buyer info was stolen and the incident has not impacted buyer programs or operations.
The corporate stated the attackers demanded a ransom to forestall the supply code from being leaked, nevertheless it has determined to not pay up.
The compromised credentials have been reset, and a forensic evaluation is being performed. Grafana has promised to share further particulars when the investigation is accomplished.
Grafana was listed on the web site of the cybercrime group Coinbase Cartel on Could 15, however no knowledge seems to have been leaked on the time of writing.
“We will trigger you extra harm than you’ll ever think about,” the hackers stated.
The gang, lively since September 2025, doesn’t use file-encrypting ransomware. As an alternative, it calls for a ransom fee after stealing delicate knowledge from victims. The Coinbase Cartel web site at present lists 105 victims.
Cybersecurity firms say Coinbase Cartel is linked to ShinyHunters, Scattered Spider, and Lapsus$, whose members have been collaborating since at the least mid-2025, with some proof pointing to a potential partnership relationship again to 2024.
The alliance has been conducting a significant knowledge theft marketing campaign, utilizing the ShinyHunters identify to signal and declare intrusions towards a number of high-profile firms, together with Instructure, Vimeo, Wynn Resorts, Vercel, and Medtronic.
