Observed Signal · May 18, 2026 · Cyberattack · Source: techcrunch · Impact: 2/5 · Sentiment: Negative
Grafana Labs: Hackers Stole Code, Company Refuses Ransom
Grafana Labs confirmed a security incident in which attackers used a stolen token credential to access the company’s GitLab environment and obtain its source code repositories. The company said the token did not grant access to customer records or financial data; it has since invalidated the token and implemented additional security measures. Attackers attempted to extort Grafana by threatening to publish the codebase, but Grafana refused to pay, citing law‑enforcement guidance. It remains unclear whether any proprietary or non-public code was taken. Grafana’s investigation is ongoing and the company said it will publish findings when the probe concludes. The report contrasts Grafana’s refusal to pay with a separate recent incident in which education‑tech firm Instructure reached an agreement to pay attackers.
Breach at a widely used open-source observability vendor highlights supply‑chain and developer tooling security risks; no customer data reported but investigation is ongoing.
Track Instructure Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Grafana Labs confirmed a breach on 2026-05-18 and disclosed that attackers accessed its GitLab environment using a stolen token credential.
- The stolen token allowed access to Grafana's source code repositories; Grafana said customer records and financial data were not accessed.
- Grafana invalidated the compromised token and added security measures to prevent a repeat incident.
- Attackers attempted to extort Grafana by demanding payment to prevent publication of the codebase; Grafana refused to pay and cited FBI guidance.
- Grafana said its investigation is ongoing and will share findings after the probe concludes.
Connected Companies & Entities
2 Entities mappedRelated Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
GitHub Hack: Data Stolen from ~3,800 Internal Repos
GitHub, owned by Microsoft, confirmed a security breach in which attackers stole data from approximately 3,800 of the company’s internal code repositories. The company said it detected and contained a compromise of an employee device that involved a poisoned Visual Studio Code (VS Code) extension. GitHub reported no evidence so far that customer information stored outside of its internal repositories was impacted, and its investigation remains ongoing. A hacking group called TeamPCP has claimed responsibility and is reportedly selling the stolen data on a cybercrime forum. The incident follows a pattern of supply‑chain attacks against developer tools and extensions, with prior related breaches affecting Trivy, the European Commission, Tanstack, and resulting targeting of other major tech organisations.
OpenAI: Hackers Stole Data After Supply-Chain Attack
OpenAI confirmed on May 14, 2026 that two employees’ devices were impacted by a recent supply‑chain attack that abused a compromised open‑source project (TanStack). After investigation, OpenAI said attackers accessed a limited subset of internal source code repositories and stole “only limited credential material,” but found no evidence that user data, production systems or intellectual property were compromised. TanStack disclosed that attackers published 84 malicious npm package versions during a six‑minute window; the malicious packages were designed to steal credentials and self‑propagate. As a precaution, OpenAI is rotating digital certificates used to sign products, an action that will require macOS users to update the app. The incident is part of a broader wave of supply‑chain compromises targeting developer tooling.
Team‑PCP steals 3,800 internal GitHub repositories
The hacker group Team‑PCP accessed approximately 3,800 internal GitHub repositories between May 18 and May 19, 2026, and is attempting to sell the stolen data. GitHub confirmed the incident on X and said no customer data was affected. According to GitHub, attackers used a compromised employee device that had a malicious Visual Studio Code extension installed; the impacted endpoint was isolated and incident response measures were taken. Team‑PCP, previously linked to a March 2026 supply‑chain attack and said to collaborate with the Ransomware‑as‑a‑Service operator Vect, is offering the GitHub data for sale and reportedly coordinated with the LAPSUS$ group in later negotiations.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.