One Token, the Whole Observatory: Grafana and the CoinbaseCartel Extortion

In the middle of May 2026, Grafana said a sentence that every company with a source-code host has rehearsed and few have had to mean.

An unauthorized party had obtained a token that could reach the company’s GitHub environment. That party had downloaded the codebase. They had then tried to blackmail Grafana, demanding payment so the stolen material would not be published. Grafana refused. The company said its investigation had found no access to customer data or personal information, and no evidence of impact to customer systems or operations. The compromised credentials had been invalidated. Extra controls had been put in front of the door the token had walked through.

Grafana did not say when the token was taken, or how long it had been valid, or which repositories the download covered. It said it had learned of the attack recently, opened a forensic analysis immediately, and identified the source of the leak. The date the public learned was on or about May 17, 2026, when The Hacker News, Security Affairs, and The Record all carried the disclosure. In an industry that timestamps everything, the missing start time is itself a finding. A token does not leave a broken window. It leaves a log of successful authentication, and only if someone is reading it.

What the Token Was Worth

Grafana is the observability company whose name has become a noun. The open-source project is how a large share of the internet looks at itself: dashboards, metrics, logs, traces. Grafana Cloud is the hosted version of that idea, a managed platform for applications and infrastructure. The company sits upstream of other companies’ visibility. That is a different kind of target from a retailer or a hospital. The prize is not a folder of credit cards. The prize is the source of the software other people trust to tell them when they are being attacked.

A GitHub token with the right scope is not a foothold. It is a checkout. Modern source hosts collapsed the old distinction between “read the repository” and “be a developer.” A personal access token, a fine-grained token, a GitHub App installation token, a long-lived secret sitting in a laptop keychain or a CI variable — any of them, if it can list and clone the organization’s private repositories, is the entire intellectual property of the firm in one HTTP header. No exploit. No malware on a build server. No phishing page, unless that is how the token was born. The attacker authenticates as automation, and automation is supposed to be allowed to clone.

Grafana’s public account matches that shape and does not go past it. An unauthorized party obtained a token. The token granted access to the GitHub environment. The codebase was downloaded. Customer data, the company said, was not part of what that token could see, or at least was not part of what the investigation found accessed. That distinction matters, and it should not be blurred. A source-code theft is not automatically a customer-data breach. It is automatically a future-vulnerability breach. Whoever holds the private tree can read the code the way a staff engineer can: the authentication paths, the places secrets are handled, the assumptions in the update mechanism, the bugs that have not been numbered yet because nobody outside the building was supposed to be reading.

The Hacker News noted that Grafana had not said which codebase was taken. The company ships more than one thing. The open-source core is already public. The value of a private download is everything that is not: cloud control planes, unreleased fixes, internal tooling, the diff between what customers run and what the next release will admit was wrong. Until Grafana says more, the honest scope is the one the company used. The GitHub environment. The codebase that token could see. Not, on the evidence they published, the customer tenants.

The Demand, and the Refusal

The second act was extortion without encryption. The attacker tried to blackmail the company. Pay, or the stolen database — Grafana’s word, in the account carried by The Hacker News — would be published. Grafana said no, and it cited the FBI.

The bureau’s position is old and still the correct one for this fact pattern. Paying does not buy deletion. It buys a promise from a counterparty who has already stolen from you, and it prices the next victim. The FBI’s public language, which Grafana pointed at, is blunt: there is no guarantee of return, and payment encourages further targets and further entrants. Grafana chose that guidance over the quiet invoice. The Record’s headline was the decision in six words. Grafana refuses to pay ransom after codebase theft.

Refusal is not free. It means the company has to assume the tree will be read by people who are not customers and not staff. It means the security team has to treat every sensitive path in the downloaded code as if a hostile reviewer has it open. It means unreleased fixes may need to ship faster than the roadmap wanted, because the bug they close is no longer known only internally. It means customers have to be told the truth Grafana did tell them — we do not see impact to your systems — and the harder truth underneath it: impact to your systems is a question about the future, not only about the past. A stolen codebase is a loaded gun that has not yet been fired at a CVE number.

This archive has watched the other choice. Days before Grafana’s disclosure, the American education-technology company Instructure had drawn public criticism for settling with a ShinyHunters extortion demand after a threat to leak school and university data. The contrast is the point. One victim paid to keep a data set dark. One victim refused, because the thing taken was source code and the bureau’s rule still applied. Neither choice restores confidentiality. They purchase different kinds of regret.

Who Claimed the Name

Grafana did not attribute the intrusion. Hackmanac and Ransomware.live did, in the sense those trackers do: a crew calling itself CoinbaseCartel claimed it.

The name is newer than the method. Halcyon and Fortinet’s FortiGuard Labs, as cited in the May reporting, assess CoinbaseCartel as a data-extortion crew that surfaced in September 2025. It does not encrypt. It steals and threatens to publish. It is assessed as an offshoot of the ShinyHunters, Scattered Spider, and LAPSUS$ ecosystem — not three groups in a trench coat, exactly, but a labor market in which brands, affiliates, and tactics circulate faster than indictments. By the time of the Grafana claim, trackers had associated the name with on the order of 170 victims across healthcare, technology, transportation, manufacturing, and business services.

A claim on a leak site is not a conviction. It is a press release from a criminal. It is still operationally useful. The ecosystem it points at has a documented preference for identity and tokens over exploits: helpdesk resets, SaaS tenants, CI secrets, GitHub credentials, the single account that can see everything because a developer needed it to see everything on a Friday. LAPSUS$ stole source code from technology companies in 2022 and extorted with the threat of publication. ShinyHunters spent the next years doing the same thing to customer databases and then, when those got harder, to the tools companies use to build software. CoinbaseCartel’s claim, if it holds, is that tradition pointed at an observability vendor.

The name is also a tell about the business model. “Cartel” is marketing. The work is freelance extortion with a shared leak site. One hundred and seventy victims is not a sign of a brilliant exploit. It is a sign of a repeatable access pattern and a publishing schedule.

What a Token Breach Requires of the Defender

Grafana said it identified the source of the leak, invalidated the credentials, and added controls. That sentence is the entire incident-response plan for this class of event, and it is harder than it sounds.

Invalidating one token is a button. Knowing which other tokens were born in the same place is an investigation. A leaked laptop, a phished developer, a secret committed to a fork, a CI job that printed its environment, a third-party integration with a standing GitHub App — each of those produces a different sibling set. “We found the source” is the claim that separates a contained token death from a week of rotating everything that ever touched the organization. Grafana made the claim. The public record does not yet include the source. Until it does, the general lesson is the one that does not depend on their forensics.

Long-lived tokens are delayed breaches. A credential that can clone every private repository should not be able to live in a place a single person, or a single malware run, can lift it. Fine-grained scopes, short lifetimes, repository rulesets that refuse a token with org-wide read, secret scanning on the way out and anomaly detection on the way in, alerts when a token clones more repositories in an hour than a human opens in a month — these are not new recommendations. They are the recommendations this incident exists to restate. The Grafana token did what it was allowed to do. That is the definition of a valid-account compromise, and it is why the customer-impact statement can be true and the security-impact statement can still be severe.

There is a second audience. Everyone who runs Grafana, or who runs software built the way Grafana is built, just watched a supplier’s private tree leave through the front door of GitHub. The rational response is not panic about dashboards. The rational response is to ask the question Grafana’s customers are entitled to ask and that Grafana’s statement began to answer: did this token see customer data, and did anything built from the stolen tree get pushed back to us? The published answer is no, and no evidence of it. The durable answer is to treat the next Grafana security release as if a hostile reader had a head start, because one did.

What a Token Is Allowed to Be

Grafana did not publish the species of token. The public record says a token, GitHub access, a downloaded codebase, credentials later invalidated. That is enough to describe the class, and the class is broader than one vendor’s forensics.

A personal access token, a fine-grained token, a GitHub App installation token, a secret sitting in a laptop keychain or a CI variable: any of them, if it can list and clone the organization’s private repositories, is the intellectual property of the firm in one HTTP header. No exploit is required. No malware has to land on a build server. No phishing page has to succeed on the day of the download, unless that is how the token was born. The attacker authenticates as automation, and automation is supposed to be allowed to clone. The log of that clone, if anyone is reading it, says success. Success is not safety. It is the token doing the job someone, at some point, asked it to be able to do.

The open-source core of Grafana is already public. That fact is the trap in the headline “source code stolen.” The value of a private download is everything that is not already on the internet: cloud control planes, unreleased fixes, internal tooling, the diff between what customers run and what the next release will admit was wrong. The Hacker News noted that Grafana had not said which codebase was taken. Until the company says more, the honest scope is the one it used. The GitHub environment. The tree that token could see. Not, on the evidence it published, the customer tenants, and not personal information. A source-code theft is not automatically a customer-data breach. It is automatically a future-vulnerability breach. Whoever holds the private tree can read the authentication paths, the places secrets are handled, and the bugs that have not been numbered yet because nobody outside the building was supposed to be reading.

Long-lived tokens are delayed breaches. A credential that can clone every private repository should not be able to live in a place a single person, or a single malware run, can lift it. Fine-grained scopes, short lifetimes, rulesets that refuse a token with organization-wide read, secret scanning on the way out, and an alert when a token clones more repositories in an hour than a human opens in a month — these are not new recommendations. They are the recommendations this incident exists to restate. Invalidating one token is a button. Knowing which other tokens were born in the same place is the investigation. A leaked laptop, a phished developer, a secret committed to a fork, a CI job that printed its environment, a third-party integration with a standing GitHub App: each of those produces a different sibling set. Grafana said it identified the source of the leak. The public record does not yet include that source. The lesson does not have to wait for it.

A Claim Is Not a Charging Document

The archive keeps the claim and the company’s statement in different sentences on purpose. Grafana confirmed the token, the download, and the extortion attempt. CoinbaseCartel, on the trackers, confirmed an appetite for the headline. A leak-site post is a press release from a criminal. It is still operationally useful, because the ecosystem Halcyon and FortiGuard describe has a documented preference for identity and tokens over exploits. LAPSUS$ stole source code in 2022 and extorted with publication, often without the malware a signature product is built to catch. ShinyHunters spent the following years doing the same thing to customer databases and then to the tools companies use to build software. If the Grafana claim holds, that tradition was pointed at an observability vendor. Until a forensic report or a prosecutor joins the name to the token, the actor line on this entry is a claim with an ecosystem assessment behind it, not a settled identity. “Cartel” is marketing. A long victim list is a publishing schedule, not proof of a brilliant exploit.

Refusal, already made, does not get cheaper with time. It means unreleased fixes may need to ship faster than the roadmap wanted, because the bug they close is no longer known only internally. It means the harder sentence under Grafana’s customer statement remains in force: impact to customer systems is a question about the future as well as the past. Days before this disclosure, Instructure had drawn public criticism for settling with a ShinyHunters demand after a threat to leak school and university data. One victim paid to keep a data set dark. One refused, because the thing taken was source code and the bureau’s rule still applied. Neither choice restores confidentiality. Grafana’s choice does not fund the next demand. It also leaves the copy where it is.

What Customers Are Entitled to Ask

Everyone who runs Grafana, or who runs software built the way Grafana is built, watched a supplier’s private tree leave through the front door of GitHub. The rational response is not panic about dashboards. The rational response is the question Grafana’s statement began to answer, and that customers are entitled to keep asking as the forensics mature. Did this token see customer data? Did anything built from the stolen tree get pushed back to us? The published answer is no, and no evidence of it. The durable operational answer is to treat the next Grafana security release as if a hostile reader had a head start, because one did.

That is the supply-chain shape of a token theft, and it is quieter than a poisoned update. Codecov’s 2021 bash-uploader incident was a modification of a tool customers ran. This incident, on the published facts, is a copy of a tree customers do not run directly. The risk moves from “the update was malicious” to “the people who read the private tree now know what the next malicious update would have to look like, and what the last unfixed bug looks like.” Defenders who only monitor the artifact that lands in production will not see that risk. It lives in the supplier’s repository until it becomes a CVE, or until it doesn’t, because the supplier shipped the fix before the reader finished the review.

Grafana’s customers can also ask a narrower question that does not require the company to narrate its forensics in public. What is the lifetime of a token that can read production source? Who is paged when that token clones more than it has ever cloned? Which repositories are private because they contain the fixes that are not ready, and are those the ones a single credential could take? Those questions are answerable without naming CoinbaseCartel. They are the questions the incident was built to force.

The Observatory, Observed

There is a grim fitness to the target. Grafana exists so that operators can see what their systems are doing. The breach was a failure of the same kind of sight, pointed inward. A token used. A clone completed. An extortion note. A company that found out “recently,” which is the word you use when the log was there and the alarm was not, or when the alarm was the criminal.

CoinbaseCartel, or whoever held the token before the claim was posted, did not need to break the observability product. They needed the credential that observes the repository. One header. The whole tree. A demand. A refusal. A public record that is still missing the start date, the scope, and the path by which the token was born.

That missing start date is the part worth sitting with. If a token can download the codebase and the first person to tell the company is the person selling it back, then the control that failed was not GitHub. GitHub did what the token asked. The control that failed was the assumption that a successful clone by a trusted secret is a success.

Grafana did the two things the moment allowed. It killed the token. It did not pay. The code, if the extortionist kept the copy, is still in someone else’s hands. That is what a refusal honestly buys: you do not fund the next one, and you do not get the last one back.

---

Attack Chain: CoinbaseCartel Claim — Grafana GitHub Token

graph TD
    A["Token Birth\nA GitHub credential able to\nread Grafana's environment\nexists — source of the leak\nidentified later, not published"] --> B["Unauthorized Use\nAttacker authenticates as\nautomation and downloads\nthe codebase\nNo exploit required"]
    B --> C["Extortion\nDemand for payment to stop\npublication of the stolen\ndatabase / source\nData-only, no encryption"]
    C --> D["Discovery\nGrafana learns of the attack\n'recently' — public disclosure\naround May 17, 2026\nForensics opened immediately"]
    D --> E["Containment\nCompromised credentials\ninvalidated\nAdditional controls added\nCustomer data not accessed\nNo evidence of customer-system impact"]
    E --> F["Refusal\nGrafana declines to pay\nCites FBI guidance:\npayment does not guarantee\nreturn and funds the next victim"]
    F --> G["Claim\nCoinbaseCartel posts the incident\non extortion trackers\nCrew assessed as a Sept 2025\noffshoot of ShinyHunters,\nScattered Spider, and LAPSUS$"]
    G --> H["Latent Risk\nPrivate tree readable by\na hostile reviewer\nUnreleased fixes and\ninternal assumptions exposed\nCustomers told: no confirmed impact"]
    H --> I["Lesson\nA token that can clone\nthe organization is the breach\nShort life, narrow scope,\nclone-volume alerts\nSuccess logs are not safety"]

    style A fill:#1a1a2e,color:#e0e0e0
    style B fill:#c0392b,color:#fff
    style C fill:#c0392b,color:#fff
    style F fill:#1a3a1a,color:#90ee90
    style I fill:#2c3e50,color:#e0e0e0