“As a first step of remediation, we have revoked a number of HF tokens present in those secrets.”
Hugging Face says intruders reached Spaces secrets and admits only that “a subset” was exposed. The fixes it lists, a key management service for secrets and removing org tokens, are basics that were missing before the breach. No user count, no timeline, no word on how the attacker got in. Customers get the chore of rotating every key.