Enterprise communication and collaboration platform Slack has informed customers that hackers have stolen some of its private source code repositories, but claims impact is limited.
Slack disclosed the incident on December 31. It’s not uncommon for companiehttp://incidentss to disclose data breaches right before or during major holidays in hopes that they will not get too much attention.
On the other hand, Slack said it learned of the suspicious activity on December 29 so it may have just wanted to inform customers about the incident as soon as possible.
The investigation showed that the attackers downloaded private code repositories on December 27. The hackers apparently gained access to the company’s externally hosted GitHub repository using stolen employee tokens. The company said a “limited number” of employees were impacted.
The compromised repositories did not contain customer data or information that could be used to access customer data. They also did not contain Slack’s primary codebase, the company said.
“Our current findings show that the threat actor did not access other areas of Slack’s environment, including the production environment, and they did not access other Slack resources or customer data. There was no impact to our code or services, and we have also rotated all relevant credentials as a precaution,” Slack explained.
