Grafana Labs GitHub Breach: Codebase Stolen and Ransom Demanded

Grafana Labs reported a security incident on May 17, 2026, where an unauthorized attacker accessed its GitHub environment using a compromised token, downloading the company's codebase. The investigation confirmed that no customer data or personal information was compromised, and there was no impact on customer systems or operations. Grafana has identified the source of the credential leak, invalidated the compromised token, and implemented additional security measures. The attacker subsequently demanded a ransom to prevent the release of the code, but Grafana decided not to pay, citing FBI guidance on ransom payments. The company plans to provide further details following the completion of its investigation.

Key Points: • An attacker accessed Grafana's GitHub environment and stole its codebase. • No customer data or personal information was compromised during the incident. • Grafana refused to pay the ransom demanded by the attacker.