Rollbar, a software bug-tracking company, recently disclosed a data breach that occurred in early August when unidentified attackers infiltrated its systems and gained access to customer access tokens.
Furthermore, the breach was uncovered by Rollbar on September 6 during a review of data warehouse logs that indicated the unauthorized use of a service account to log into the cloud-based bug monitoring platform. Within the three days of access between August 9 and August 11, 2023, the threat actors conducted a search for sensitive information, focusing on cloud credentials and Bitcoin wallets.
The compromised data includes a range of sensitive customer information, encompassing usernames, email addresses, account names, and project-related details, such as environment names and service link configurations.
Additionally, the attackers managed to obtain project access tokens, which enable customers to interact with Rollbar projects. Rollbar has taken swift action to mitigate the breach’s impact, expiring access tokens related to project data and scheduling the expiration of tokens that allow data submission to an active project within 30 days.
While the investigation into the incident is ongoing, Rollbar has emphasized its commitment to prioritizing the security of customer data. The company plans to engage a third-party forensic consultant to further validate their findings and ensure comprehensive security measures.
Rollbar’s error logging and tracking services are widely used, serving over 400 million application end-users and thousands of companies worldwide, including prominent names such as Salesforce, Twilio, Uber, Twitch, and Pizza Hut.
