CircleCI's incident report says malware on one engineer's laptop stole a session cookie from a valid, two-factor-backed login, letting an attacker impersonate that employee and reach production systems. Customer secrets stored in the service had to be rotated. It was a stolen session, not a bypassed second factor.
Timeline from the report
All dates are from CircleCI's own report, in UTC:
- 16 December 2022: malware, which antivirus did not detect, reached an engineer's laptop.
- 19 December: unauthorized access and reconnaissance began.
- 22 December: data was taken from a subset of production databases and stores, the last recorded unauthorized production activity.
- 29 and 30 December: a customer reported suspicious GitHub OAuth activity, and CircleCI learned a customer's token had been compromised.
- 4 January 2023: the scope and entry path were determined, and access was cut.
- 5 January: customer notices went out and all Project API Tokens were revoked.
How the attacker got in
The report says the malware stole session cookies. The attacker used them to act as the employee from outside. CircleCI describes this as a valid session with the second factor already completed. The employee's legitimate ability to generate production access tokens then allowed access to a subset of production systems. The attacker also extracted encryption keys from a running process, so data encrypted at rest could in principle be decrypted.
What was exposed
Customer environment variables, tokens and keys, including credentials for other systems. The report says fewer than five customers had reported unauthorized access to third party systems at publication.
What customers were told to do
Rotate all secrets stored in the service, treat secrets stored during the exposure window as compromised, review activity from 16 December 2022 until rotation, check the published indicators and look in GitHub audit logs for unexpected commands.
Lessons for any service that holds secrets
- Short session lifetimes and device bound sessions blunt cookie theft. A 2FA prompt at login does not help once the session exists.
- Limit who can mint production access tokens, and require step up authentication for it. CircleCI says it did this afterwards.
- Do not keep encryption keys where one process compromise reveals them.
- Give customers a way to see and rotate their secrets quickly. CircleCI released a secret finding script and made audit logs available to all customers.
- Prefer OIDC and short-lived credentials over stored long-lived secrets, as the report says it would make easier for customers.
For customers of any CI platform
Keep a list of every secret stored there and the systems it opens. If the vendor reports an incident, rotation should be a runbook, not a project. See the rotation runbook.
Quick check
Did the attacker break two-factor authentication?
The report says no. A valid session that had already passed the second factor was stolen.
Why did customers have to rotate so many things?
The service stored customer secrets and the attacker reached data stores holding them, so any of those secrets could be exposed.
Sources
- CircleCI, January 4, 2023 security incident report.
Last reviewed: 19 October 2026.
