# Grafana Labs Source Code Theft via Stolen GitHub Access Token — CoinbaseCartel Extortion Campaign

> Grafana Labs disclosed on May 18, 2026 that attackers used a stolen GitHub access token to download portions of its source code. The CoinbaseCartel extortion gang — composed of ShinyHunters and Lapsus$ affiliates — listed Grafana on its data leak site and demanded a ransom, which Grafana refused per FBI guidance. Grafana found no evidence of customer data or production system compromise.

- **Published:** 2026-05-18T12:00:00Z
- **Last reviewed:** 2026-05-18T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0527
- **ID:** TL-2026-0527
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** CoinbaseCartel
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 18, 2026, observability vendor Grafana Labs publicly disclosed that an unauthorized actor used a stolen GitHub access token to gain access to its GitHub environment and download proprietary source code. The disclosure followed the appearance of a Grafana entry on the data leak portal of the CoinbaseCartel extortion gang, which demanded payment in exchange for non-publication of the stolen codebase.

Grafana stated that its forensic investigation traced the breach to a single compromised access token, that customer-facing production systems were unaffected, and that there was no evidence of exposure of customer data or personal information. The company invalidated the compromised credentials, implemented additional hardening measures around its source repositories, and pledged a fuller post-incident write-up. Grafana followed FBI guidance and declined to pay the ransom.

CoinbaseCartel emerged in September 2025 and is publicly assessed by researchers to consist of affiliates aligned with the ShinyHunters and Lapsus$ ecosystems. The gang's standing tradecraft, observed across 100+ claimed victims, leans on social engineering (vishing of help desks, SSO-portal phishing kits), abuse of stolen OAuth and personal access tokens from developer endpoints (commonly via infostealer logs), and abuse of trusted SaaS integrations such as GitHub Apps, OAuth-bound CI runners, and Salesforce Data Loader. The gang has been linked by independent researcher Joe Shenouda to an in-memory ESXi encryptor dubbed 'shinysp1d3r' that targets VMware ESXi hypervisors and disables snapshots prior to encryption; ShinyHunters has publicly distanced itself from the CoinbaseCartel brand. The Grafana intrusion fits the broader pattern of GitHub-token-driven source-code extortion that has affected multiple high-profile SaaS vendors throughout 2025-2026.

The access vector for the Grafana breach — a long-lived GitHub PAT or fine-grained token leaked from a developer endpoint or third-party integration — is consistent with the gang's documented playbook of mining stealer logs (Lumma, Rhadamanthys, StealC, Vidar) for cookies, refresh tokens, and PAT strings, then exercising those tokens to enumerate organization-private repositories, archive them via the GitHub REST API (`/repos/{owner}/{repo}/zipball`), and exfiltrate the archives over HTTPS to attacker-controlled object storage. Because GitHub PATs and GitHub App installation tokens inherit a broad set of repo-, actions-, and packages-scoped privileges, a single leaked token is sufficient to enumerate and clone entire organizations without triggering interactive MFA. CoinbaseCartel's extortion-only posture — no ransomware deployed against the victim's own environment — distinguishes the Grafana incident from a shinysp1d3r-style ESXi attack and shifts the leverage entirely onto reputational and source-code-exposure risk.

Defensive priorities for Grafana customers and similarly exposed SaaS vendors include: enforcing fine-grained GitHub tokens with per-repo scopes and short TTLs, eliminating long-lived PATs in favor of OIDC-federated workload identity, requiring SSO + hardware-bound passkeys for all developer GitHub access, restricting repository archive downloads via GitHub audit policy and anomaly detection on `git.clone` / `git.fetch` volume, monitoring infostealer-log marketplaces for organization-scoped credentials, and exercising rapid token-rotation and repo lockdown playbooks. Source-code exposure of an observability platform raises secondary risk of secret leakage (embedded test credentials, signing keys, customer-tenant identifiers) and second-stage exploit development against unpatched code paths; downstream Grafana operators should prepare for an uptick in targeted exploit research against Grafana OSS and Grafana Enterprise.

## MITRE ATT&CK

- T1650 Acquire Access
- T1078 Valid Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1199 Trusted Relationship
- T1566 Phishing
- T1528 Steal Application Access Token
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1526 Cloud Service Discovery
- T1087.004 Account Discovery: Cloud Account
- T1213 Data from Information Repositories
- T1213.003 Data from Information Repositories: Code Repositories
- T1102 Web Service
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Sources

- [Grafana says stolen GitHub token let hackers steal codebase](https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/)
- [Grafana Labs Security Incident Disclosure (May 2026)](https://grafana.com/blog/)
- [FBI IC3 Guidance — Do Not Pay Ransomware/Extortion Demands](https://www.ic3.gov/Media/Y2023/PSA230908)
- [GitHub Docs — Managing your personal access tokens (fine-grained)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
- [GitHub Docs — Reviewing the audit log for your organization](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization)
- [MITRE ATT&CK T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [MITRE ATT&CK T1213.003 — Code Repositories](https://attack.mitre.org/techniques/T1213/003/)
- [CISA Alert AA24-241A — ShinyHunters/Lapsus$ ecosystem TTPs (background)](https://www.cisa.gov/news-events/cybersecurity-advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0527