how it happened
- whoattackertoken for Sisense GitLab
- the gapsecrets storagecustomers' connection credentials
- the resultCISA alertall customers told to reset
what everyone assumed
The reasonable way to think about an analytics vendor is that it shows you your numbers, so the worst case is that it loses a copy of those numbers. The belief that follows is that the relationship is read-only and contained, a window onto your data rather than a door into it. What that belief overlooks is the bundle of live credentials the platform has to keep on your behalf to make any of it work.
what happened
The exposure lived where customers could not see it: inside Sisense’s own development environment. A token gave access to a self-managed GitLab repository, and from there to cloud storage holding the platform’s secrets, including access tokens, certificates, and the credentials it used to connect to customer systems. For an unknown stretch before discovery, the keys to many companies’ data sat reachable in one place, behaving exactly as keys do when nobody knows to change them.
step by step
- a token opens Sisense's own GitLabInside the vendor, out of customers' sight.
- cloud storage holds the platform's secretsIncluding credentials it uses to reach customer systems.the assumption breaks here
- keys to many companies' data in one placeFor an unknown stretch before discovery.
- April 2024CISA tells customers to reset everythingAD, Git, web tokens, SSO secrets.
how it surfaced
In April 2024, the US Cybersecurity and Infrastructure Security Agency took the unusual step of publishing an alert about a private company, urging Sisense customers to reset credentials and secrets that could be used to reach Sisense services. The reset list was long because the access had been broad: Active Directory credentials, GIT credentials, web access tokens, single sign-on secrets. The breach did not leak the dashboards. It leaked the keys that drew them.
A tool that reports on your systems is also a tool that can reach your systems, and the credentials it holds to do its job are yours to lose when it is breached.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe vendor is breached and the keys are copied.what it costs youYou have to change every connection you ever gave that vendor, at short notice.
- or it goes like thisit happenedSalesloft / Drift, 2025howA chat tool's key into your CRM is stolen from the vendor.what leavessupport tickets, including passwords pasted into themwho ends up with itan extortion group working through hundreds of companies
- or it goes like thisit happenedGitHub OAuth tokens, 2022howIntegration keys to your code host are stolen from the integration vendor.what leavesyour private code and the secrets inside itwho ends up with itattackers looking for the next door
sources
your turn
what you can do about it
this week
Look at which third-party tools hold live tokens or keys into your environment, and whether you could rotate those credentials quickly if that vendor announced a breach tomorrow.
Somewhere in your stack is a reporting or analytics tool you connected once and stopped thinking about, holding a credential that still reaches a real system. The assumption to retire is that a vendor which only shows you data cannot also hand someone the way in. The companies that moved fastest after Sisense were the ones who already knew what they would have to reset.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →