--- title: Grafana Labs had its source code stolen, declined to pay... description: Grafana Labs had its entire private codebase stolen by an extortion group called CoinbaseCartel after a single GitHub access token was missed during rotation.... canonical: https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Grafana Labs had its source code stolen, declined to pay ransom | daily.dev og:description: Grafana Labs had its entire private codebase stolen by an extortion group called CoinbaseCartel after a single GitHub access token was missed during rotation.... og:url: https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3 og:image: https://api.daily.dev/og/posts/RAwKHJgD3.png og:image:alt: Grafana Labs had its source code stolen, declined to pay ransom og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Grafana Labs had its source code stolen, declined to pay ransom **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 1 comments ## Summary Grafana Labs had its entire private codebase stolen by an extortion group called CoinbaseCartel after a single GitHub access token was missed during rotation. The breach originated from the TanStack npm supply chain attack (campaign 'Shai Hulud'), where malicious packages compromised via GitHub Actions cache poisoning exfiltrated CI/CD tokens. Grafana refused to pay the ransom, noting much of its code is already open source. The breach was detected via a canary token. The broader campaign also hit GitHub, Mistral AI, and OpenSearch. Key takeaways: private repos contain ~6x more hardcoded credentials than public ones, and stolen source code can accelerate future attacks through AI-assisted vulnerability discovery. Recommended mitigations include regular secret scanning, least-privilege CI/CD tokens, build environment isolation, and honeytokens. ## Content ## What happened Grafana Labs had its entire codebase stolen by an extortion group called CoinbaseCartel. The attackers got in through a single GitHub access token that should have been rotated but wasn't. The root cause traces back to the TanStack npm supply chain attack, part of a broader campaign called "Shai Hulud" run by a group known as TeamPCP. The attack worked by compromising 373 npm packages across 169 namespaces through GitHub Actions cache poisoning and OIDC token extraction. When Grafana's CI/CD pipeline pulled in malicious TanStack packages, credential-stealing code ran and exfiltrated GitHub tokens from the environment. Grafana rotated most of the exposed tokens. One was missed. That was enough. Using the overlooked token, attackers accessed Grafana's private GitLab repositories and downloaded the source code along with some business contact information. The breach was caught via a canary token. ## What wasn't compromised Grafana says no customer production data, financial records, or operational systems were touched. The codebase itself wasn't modified — only copied. The company has since invalidated the stolen token and added additional security controls. ## The ransom demand CoinbaseCartel threatened to release the stolen code unless Grafana paid up. Grafana refused, citing FBI guidance that paying ransoms doesn't guarantee data safety and funds future attacks. There's an obvious irony here: much of Grafana's code is already open source. The attackers were essentially threatening to release code that anyone could already download. Grafana pointed this out. Compare that to Instructure (Canvas), which reportedly paid around $10 million after a breach that involved actual student and staff personal data — a situation where the leverage was real. ## Who is CoinbaseCartel CoinbaseCartel has been active since around September 2024 and has claimed over 100 victims. The group is linked to affiliates of ShinyHunters and Lapsus$, using social engineering, phishing, and compromised credentials to get in. Grafana wasn't their only recent target — GitHub itself and Mistral AI were also hit through the same cascading supply chain attack. ## The broader supply chain problem The Shai Hulud campaign hit more than just Grafana. TanStack, Mistral AI, and OpenSearch were all affected. TeamPCP later open-sourced the worm and posted a $1,000 competition on Breach Forums for whoever could pull off the largest supply chain attack. That's not a group trying to stay quiet. Around the same time, RubyGems was hit by a separate coordinated bot attack that published over 500 malicious packages targeting cross-site scripting data exfiltration. ## Why stolen private code matters even when it's "just code" Private repositories contain roughly six times more hardcoded credentials than public ones. Stolen source code isn't just embarrassing — it's often a map to the next attack. With AI-assisted code analysis, finding exploitable vulnerabilities in a leaked codebase is faster than it used to be. Recommended mitigations: scan private repos for secrets regularly, apply least-privilege access to CI/CD tokens, use network isolation and containerization for build environments, and deploy honeytokens so you find out quickly when something's been accessed that shouldn't be. Grafana's canary token is what caught this breach. That part, at least, worked. ## Community discussion Top comments from developers on daily.dev. **@ralsei** · 0 upvotes > "All your open-source code are belong to us" --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#gitlab](https://daily.dev/tags/gitlab), [#grafana](https://daily.dev/tags/grafana) [View this post on daily.dev](https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Grafana Labs had its source code stolen, declined to pay ransom","url":"https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3"},"datePublished":"2026-05-18T13:47:41.232Z","dateModified":"2026-05-22T13:52:57.833Z","description":"Grafana Labs had its entire private codebase stolen by an extortion group called CoinbaseCartel after a single GitHub access token was missed during rotation....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8f7b13b4b9fd72de7f88eb1920c589f8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8f7b13b4b9fd72de7f88eb1920c589f8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"ransomware,gitlab,grafana","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Grafana Labs had its source code stolen, declined to pay ransom"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/grafana-labs-had-its-source-code-stolen-declined-to-pay-ransom-rawkhjgd3","comment":[{"@type":"Comment","text":"“All your open-source code are belong to us”","datePublished":"2026-05-19T14:39:30.852Z","url":"https://daily.dev/posts/RAwKHJgD3#c-vyFUAPwiy","author":{"@type":"Person","name":"Ralsei","url":"https://daily.dev/ralsei","image":"https://media.daily.dev/image/upload/s--4OFiaBRW--/f_auto/v1770997251/avatars/avatar_GZQ6TUkl08VeKSBvLh49j?_a=BAMAMiiu0"}}]} ```