“the build information for each past build contains a link to the git repository, including the bitbucket credentials in the url.”
OptimEyes sells cyber risk visualization and IP theft prevention. An anonymous 4chan user dumped its full source code, trained ML models, customer data and hardcoded credentials. The likely way in was a Jenkins server that printed Bitbucket passwords into every build record. Customer vulnerability scans, apparently including Hitachi Energy’s, went out with it. The company that maps your risk forgot to check its own CI.