In April 2024, Sisense, a business intelligence company whose dashboards connect to its customers' databases and SaaS services, told customers to rotate every credential they used within its platform. On 10 April its chief information security officer, Sangram Dash, said the company had learned that "certain Sisense company information may have been made available on what we have been advised is a restricted access server." The next day the US Cybersecurity and Infrastructure Security Agency (CISA) said it was responding to a compromise discovered by independent researchers and urged customers to reset credentials and secrets exposed to or used with Sisense. According to two sources who spoke to KrebsOnSecurity, the attackers got into Sisense's self-managed GitLab code repository, found a token or credential there that gave access to Sisense's Amazon S3 buckets, and copied several terabytes of customer data, apparently including millions of access tokens, email account passwords and SSL certificates. Sisense declined to comment on those details.
Key takeaways
- Sisense told customers on 10 April 2024 to rotate credentials used within its platform; CISA issued its own alert on 11 April.
- Sources told KrebsOnSecurity that a token or credential in Sisense's GitLab repository gave attackers access to its S3 buckets.
- The stolen data reportedly included millions of access tokens, email account passwords and SSL certificates belonging to customers.
- Sisense's later advice covered passwords, SSO secrets, Active Directory and Git credentials, and web access tokens.
- The identity lesson: a platform that holds customers' keys concentrates risk, and one secret left in a code repository can expose all of them.
At a glance
| Organisation | Sisense (business intelligence and analytics platform) and its customers |
|---|---|
| When | Disclosed to customers 10 April 2024; CISA alert 11 April 2024 |
| Attacker | Unattributed |
| Entry point | Access to Sisense's self-managed GitLab repository, according to sources quoted by KrebsOnSecurity |
| Identities abused | A token or credential in GitLab giving S3 access; customer access tokens, passwords and certificates stored by Sisense |
| Impact | Several terabytes of customer data reportedly copied; customers told to rotate all credentials used with Sisense |
| Category | NHI. Incident class: confirmed NHI breach (repository credential used to reach cloud storage of customer secrets) |
What happened
Sisense's first message to customers, published by KrebsOnSecurity, said: "We are taking this matter seriously and promptly commenced an investigation." It added: "Out of an abundance of caution, and while we continue to investigate, we urge you to promptly rotate any credentials that you use within your Sisense application." CISA followed on 11 April. Infosecurity Magazine reported that the agency was "currently collaborating with private industry partners to respond to a recent compromise discovered by independent security researchers impacting Sisense," and CISA said it was taking an active role "especially as it relates to impacted critical infrastructure sector organizations."
KrebsOnSecurity reported what two sources close to the investigation said: "the breach appears to have started when the attackers somehow gained access to the company's Gitlab code repository, and in that repository was a token or credential that gave the bad guys access to Sisense's Amazon S3 buckets in the cloud." The sources said the attackers "used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates." Sisense declined to respond to those details.
Sisense's follow-up advice was far broader. Customers had to "reset any keys, tokens, or other credentials in their environment used within the Sisense application," including passwords, SSO shared secrets, Microsoft Active Directory credentials, Git credentials and web access tokens. Help Net Security quoted Marc Rogers, head of security at DEF CON, on why this mattered: "The nature of sisense is they require access to their customers confidential data sources. They have direct access to JDBC connections, to SSH, and to SaaS platforms like Salesforce and many more."
Timeline
| Date | Event |
|---|---|
| 10 April 2024 | Sisense tells customers to rotate credentials used within its application. |
| 11 April 2024 | CISA issues an alert; KrebsOnSecurity reports the GitLab-to-S3 route from sources; Sisense sends detailed reset instructions. |
| 12 April 2024 | Infosecurity Magazine reports CISA's call for an immediate credential reset. |
How it happened: the identity attack path
- Code repository accessed. Attackers gained access to Sisense's self-managed GitLab, according to Krebs' sources; how is not known.
- Cloud credential found. A token or credential in the repository gave access to Sisense's S3 buckets.
- Customer secrets copied. Several terabytes of data, reportedly including access tokens, passwords and certificates, were taken.
- Downstream exposure. Those credentials connected Sisense to customers' databases and SaaS services.
- Mass rotation. Sisense and CISA told customers to reset every credential used with Sisense.
Impact
- Data: several terabytes of customer data, reportedly including millions of access tokens, email account passwords and SSL certificates.
- Customers: Sisense has more than a thousand customers across finance, telecoms, healthcare and education, according to KrebsOnSecurity.
- Response: customer-wide credential rotation and a CISA alert.
What this means for NHI governance
This breach is a chain of non-human identities. A credential in a code repository opened cloud storage, and that storage held the tokens, passwords and certificates that let Sisense connect to its customers. As KrebsOnSecurity observed, access tokens can let an attacker "authenticate as the victim without ever having to present valid credentials," and only the customers themselves could revoke them.
Two lessons follow. Vendors that store customer credentials must keep them encrypted, isolated and out of reach of build and code systems. Customers must know which of their credentials each vendor holds and be able to rotate them quickly. See our Third-Party Access Guide and Secrets Management Guide.
Recommendations
- Keep cloud credentials out of repositories. Scan code and history, and use workload identity instead of stored keys. See our Secrets Management Guide.
- Encrypt stored customer secrets. Vendors should keep customer credentials in a vault, not plain storage. See the Cryptographic Key Management Guide.
- Inventory credentials given to vendors. Know what each provider holds so you can rotate on notice. See the Third-Party Access Guide.
- Scope connector credentials. Give analytics tools read-only access to only the data they need. See the SaaS and OAuth App Governance Guide.
- Rotate and monitor after a vendor breach. Watch for use of rotated credentials. See the Leaked Credential Response Playbook.
Frequently asked questions
What happened in the Sisense breach?
Sisense told customers in April 2024 that company information had been exposed and asked them to rotate credentials. Sources told KrebsOnSecurity that attackers used a credential in Sisense's GitLab repository to reach S3 buckets holding customer data.
Why did CISA get involved?
CISA said it was responding to the compromise with industry partners, especially where critical infrastructure organisations were affected, and urged customers to reset credentials.
What should Sisense customers have rotated?
Every key, token and credential used within Sisense, including passwords, SSO secrets, Active Directory and Git credentials and web access tokens.
Related NHI Mgmt Group resources
Sumo Logic Breach 2023 · Snowflake Breach 2024 · Third-Party Access Guide · Secrets Management Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
Vendors that hold your credentials extend your attack surface. We help teams map what each provider holds, scope connector access and rotate at speed. See our NHI and AI agent security training.