“Zuber said that while customer data was encrypted, the cybercriminals also obtained the encryption keys able to decrypt customer data.”
One employee laptop with token-stealing malware gave intruders CircleCI production access from December 16 through January 4. Two-factor authentication did nothing because a stolen session token skips it. The attackers took customer environment variables, tokens and keys, plus the keys to decrypt them. Every company that handed its deploy secrets to a CI vendor now gets to rotate all of them.