“As demonstrated by this message, this includes a Zendesk token with perms to access 800K+ support tickets sent to [email protected] since 2018.”
The hacker who took 33 million user records came back through a Zendesk token the Internet Archive never rotated. The original GitLab token sat exposed since at least December 2022. People who uploaded ID to get pages pulled from the Wayback Machine now have that ID in a stranger’s hands. BleepingComputer warned the Archive repeatedly and never got a reply.