Breach Teardown
What Caused the CircleCI Breach?
On December 16, 2022, malware landed on a CircleCI engineer’s laptop and antivirus missed it. It did not steal a password. It stole something better: a valid, 2FA-backed SSO session, ready to replay. Twelve days of impersonation later, the attacker had exfiltrated customer environment variables, tokens, and keys, and every CircleCI customer was rotating every secret they had ever stored.
By Vidyaa Ganesh, Founder, Identara
- Scale
- Every customer told to rotate all stored secrets and tokens
- Attack vector
- Malware-stolen SSO session cookie; 2FA never failed
- IAM domains implicated
- Auth/SSO, PAM, Security
- Domino controls hit
- 2 of 4
The Incident
What Happened
On January 4, 2023, CircleCI told customers to rotate all secrets stored on the platform, including OAuth tokens, project API tokens, and SSH keys. The subsequent incident report explained why. Malware deployed to an engineer’s laptop on December 16, 2022 had stolen a valid, 2FA-backed SSO session, and the company’s antivirus had not detected it.
With the stolen session, the attacker impersonated the engineer remotely. Because that employee had privileges to generate production access tokens, the impersonation escalated into production access. On December 22, the attacker accessed and exfiltrated data from a subset of databases, including customer environment variables, tokens, and keys for third-party systems. The data was encrypted at rest, but the attacker extracted encryption keys from a running process, enabling access to the encrypted data anyway.
Detection came from outside. On December 29, a customer alerted CircleCI to suspicious GitHub OAuth activity, which triggered the internal investigation that uncovered the compromise. For a platform whose product is holding other companies’ credentials, the incident turned one unmanaged endpoint compromise into a secrets-rotation event across the entire customer base.
Attack Chain
How the Attack Compounded
Each step below marks the AXIS control that failed at that point in the chain, where one applies. Steps without a control marker were outside the victim's direct span of control.
Malware lands on a CircleCI engineer’s laptop on December 16, 2022, and endpoint antivirus does not detect it.
AUTH-03
The malware steals a valid, 2FA-backed SSO session cookie. The attacker impersonates the engineer without ever facing a login prompt.
AUTH-04
The engineer’s privileges include generating production access tokens, so a stolen desktop session escalates into production reach.
PAM-02
On December 22, customer environment variables, tokens, and keys are exfiltrated; encryption keys pulled from a running process defeat encryption at rest.
PAM-02
On December 29, a customer reports suspicious GitHub OAuth activity. Detection arrives from the victim side, thirteen days after the malware landed.
SEC-01
Control Mapping
The IAM Controls That Failed
Every failure point below corresponds to a control in the AXIS question bank, the same 4 controls a maturity assessment would have scored before this incident.
| Control | Domain | Capability | How it failed here |
|---|---|---|---|
| AUTH-04 | Auth/SSO | Phishing-Resistant MFA & Session Integrity | The 2FA held; the session it minted did not. A stolen cookie is an MFA bypass that never touches MFA, which is why this control measures session integrity, binding sessions to devices, keeping production-scoped sessions short-lived, and re-challenging before sensitive actions, not just factor strength at login. |
| AUTH-03 | Auth/SSO | Device Trust & Zero Trust Enforcement | The endpoint carrying production-capable sessions ran malware for days without detection or quarantine. Device trust means access to production tooling depends on continuously verified device posture, so a compromised laptop loses its sessions rather than lending them out. |
| PAM-02 Domino | PAM | Secrets Management (Non-Human & Application Credentials) | Customer secrets were encrypted at rest, but the decryption keys were extractable from a running process by an impersonated employee session. Secrets management maturity is measured at the key ceremony: who can reach key material, from where, and with what step-up. |
| SEC-01 Domino | Security | Identity Threat Detection & Response (ITDR) | The compromise surfaced through a customer’s GitHub OAuth alert, not internal telemetry. Thirteen days elapsed between malware landing and detection, a week of it after exfiltration was already complete. |
The Maturity Lesson
What Would Have Changed the Outcome
The Domino Effect
PAM-02 and SEC-01 are both domino controls, and this incident shows why they compound for a platform business. A secrets store is only as strong as the sessions that can reach its keys, and detection outsourced to your customers is detection that arrives after exfiltration. The supply-chain multiplier is the real story: one endpoint compromise at a CI/CD vendor became a mandatory rotation event for thousands of downstream engineering teams.
The Maturity Level That Mattered
At level 2 or 3 on AUTH-04, sessions are bound to the device that earned them and production scopes require re-authentication, so a copied cookie dies on replay. At level 2 or 3 on AUTH-03, production-capable access requires a healthy managed device, and an endpoint that stops attesting drops its sessions.
The assessment question for any platform team: whose laptops can mint your production credentials, and what happens to those sessions the moment the laptop is no longer trustworthy? And for everyone downstream of such platforms: your vendor’s AUTH-03 score is part of your secrets-management posture, whether you assessed it or not.
Related Compliance Frameworks
The controls implicated in this breach carry citations in these frameworks within the AXIS bank:
Put a Number on It
What Would a Breach Like This Cost You?
The breach cost calculator turns a failure pattern like the one above into a dollar figure. Set your identity count, pick your industry, give an honest read of your IAM maturity, and see the annualized loss exposure it implies.
Run the Breach Cost CalculatorAbout This Analysis
This teardown is based exclusively on public disclosures, regulatory findings, and reporting cited above; it makes no claim of insider knowledge about the internal environment at CircleCI. Control mappings express how the publicly documented failure points correspond to capabilities in the AXIS methodology, for educational purposes. AXIS is not affiliated with CircleCI.
More From the Breach Radar
What Caused the Okta Support System Breach?
Service account credential exposed via a personal browser profile
What Caused the LastPass Breach?
Keylogger on an engineer’s home computer via vulnerable media software
What Caused the Salesloft Drift Breach?
Stolen OAuth tokens from a chatbot integration
Would Your Program Have Caught This?
The 4 controls that failed here are questions in the AXIS assessment. Score your organization against them, and the rest of the bank, in about 20 minutes. No signup required to start.