“Our investigation also revealed that the threat actor downloaded private code repositories on December 27.”
Attackers used stolen employee tokens to download Slack’s private repositories on December 27. Slack noticed two days later and announced it over the holidays. The notice carried a noindex tag buried at the bottom of the page’s HTML, so search engines would skip it. Slack’s August password-hash notice got the same treatment. A company that hides its breach notices from Google is managing headlines, not risk.