image credit: adobe stock
Cloud application platform Heroku has confirmed that the recent cybersecurity incident, in which GitHub integration OAuth tokens were stolen, has led to further compromise, and ended up with customer credentials being stolen.
After some pressure by the community, to provide more clarity surrounding the incident, and why it started sending out password reset emails to its customers, the Salesforce-owned company confirmed that the compromised tokens were used, by unknown thread actors, to obtain hashed and salted passwords, belonging to its customers, from “a database”.
Comments are closed.
