Forest Global Training Partners

Cyber Risks · Krebs on Security

Why CISA is Warning CISOs About a Breach at Sisense

Summary: CISA said it is investigating a breach at business intelligence company Sisense, whose dashboard products are used by more than a thousand customers in financial services, telecommunications, healthcare and higher education, and it urged customers to reset credentials and secrets shared with the company. Two sources with knowledge of the investigation told KrebsOnSecurity the attackers reached Sisense's self-managed GitLab code repository, used a token or credential found there to access the company's Amazon S3 buckets, and copied and exfiltrated several terabytes of customer data that apparently included millions of access tokens, email account passwords and SSL certificates.

Bottom line: Unknown attackers now hold the credentials Sisense customers used in their dashboards, and because access tokens can authenticate as the victim without valid credentials and sometimes remain valid indefinitely, the cleanup falls largely to each customer - Sisense's CISO directed resets across Active Directory, GIT, SSO, web access tokens and database credentials.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related