Grafana lost its codebase to Coinbase Cartel, the new offshoot of ShinyHunters, Scattered Spider, and LAPSUS$.

WHAT GRAFANA DISCLOSED

Grafana Labs published its disclosure on May 17 across the company's social channels and an official statement. The substantive details are direct. An unauthorized party obtained a token that granted access to the Grafana Labs GitHub environment. The token gave the attacker the ability to download the company's codebase. The intrusion did not involve any customer-facing systems. No customer information, no personal data, and no operational impact on Grafana Cloud or other production services per the company's statement.

The attacker subsequently contacted Grafana demanding payment to prevent the public release of the stolen source code. Grafana declined to pay. The company referenced standing FBI guidance that ransom payment does not guarantee recovery or deletion of stolen data and that payment financially motivates additional criminal activity against other organizations. Grafana has reset the compromised credentials, engaged forensic analysis, and committed to share further details when the investigation completes.

The disclosure window is significant. Coinbase Cartel listed Grafana on its leak site on Friday May 15. Grafana confirmed the breach on Sunday May 17. The two-day gap between leak site listing and corporate disclosure suggests Grafana was in negotiation or assessment during the period before deciding the disclosure was appropriate. The fact that Grafana published before paying any ransom is the operationally important detail. The company chose transparency over the alternative.

WHO COINBASE CARTEL ACTUALLY IS

Per analysis published by Halcyon and Fortinet FortiGuard Labs, Coinbase Cartel is a data extortion crew that first appeared in September 2025. The group is assessed as an offshoot of the broader cybercrime alliance sometimes called Scattered Lapsus$ Hunters or Trinity of Chaos. That supergroup formed earlier in 2025 from members of three established cybercrime entities: ShinyHunters, Scattered Spider, and LAPSUS$.

Each of the three parent groups brought distinct tradecraft. ShinyHunters is best known for high-volume data breaches and stolen-database sales across dozens of organizations over the past several years. Scattered Spider built its reputation on social engineering and SIM swapping operations targeting telecom and identity infrastructure. LAPSUS$ became notorious for high-profile breaches against Microsoft, Okta, and NVIDIA in 2022. Coinbase Cartel inherited methodology from all three: stolen credentials, phishing, social engineering, cloud abuse, and compromise of developer environments.

The group's operational profile is data theft and extortion exclusively. They do not encrypt systems like traditional ransomware groups. The product is the stolen data and the threat is public release. They have amassed more than 170 named victims across healthcare, technology, transportation, manufacturing, and business services since emerging in September 2025. The campaign cadence is approximately one new claimed victim per week on average, which makes Coinbase Cartel one of the highest-volume data extortion operations currently active.

The Atarus body of work has covered the same ecosystem repeatedly across the past three weeks. The May 5 Canvas / Instructure breach was attributed to the same ShinyHunters-aligned ecosystem. The Trellix breach on May 4 followed the same source-code-as-prize pattern. The Checkmarx Jenkins plugin compromise on May 13 was a parallel operation by TeamPCP, a separate but adjacent threat actor in the same broader campaign environment. Today's Grafana disclosure extends the named-threat-actor body of work that Atarus has been assembling: Coinbase Cartel as a specific tracked entity inside the larger Scattered Lapsus$ Hunters ecosystem.

SOURCE CODE AS THE PRIZE

The Grafana attack reflects a pattern in the broader extortion economy that has accelerated over the past year. Source code is increasingly the target rather than customer PII or operational system control. The reasoning is straightforward. Source code is portable. It can be analyzed at leisure. It does not require active operational exploitation to monetize. It enables downstream supply chain attacks against the victim's customers. And the public release threat against a company's intellectual property carries different reputational weight than a customer-data leak that the company can frame as a third-party breach.

The Atarus blog covered the structural version of this argument in the Trellix post on May 4. Trellix lost source code to an unnamed attacker. Checkmarx lost source code to TeamPCP across three waves in three months. Now Grafana has lost source code to Coinbase Cartel. The targets share common characteristics. They are software companies whose product is the code itself. Their customers extend trust based on the assumption that the codebase is closed. The compromise of the codebase invalidates assumptions across the entire customer base, regardless of whether the customer data itself was affected.

The defender response is structural. Source code repositories are now production infrastructure. The same access controls, the same monitoring, the same incident response disciplines that apply to customer-facing systems need to apply to development infrastructure. Most organizations still treat the development side as a lower-priority security domain. The historical pattern across Trellix, Checkmarx, Grafana, and the broader supergroup activity argues that this is no longer a defensible posture. The first line of the UnderCode News coverage of this incident states the point directly: development infrastructure is no longer separate from production risk. It is production risk.

THE GITHUB TOKEN VECTOR

The specific compromise mechanism in the Grafana case deserves practitioner attention. Grafana confirmed that the attacker obtained a token granting access to the GitHub environment. The token type, the scope, and the exfiltration method have not been publicly disclosed. The attack vector category, however, is the same one Atarus has been documenting across multiple recent incidents.

GitHub Personal Access Tokens, OAuth application tokens, GitHub Actions tokens, and Deploy Keys are all credential types that grant programmatic access to repositories. Each one is typically created for a legitimate operational purpose and then forgotten. Each one has a scope that may be broader than the immediate operational need. Each one is rarely rotated on the cadence that the threat environment now requires. The Coinbase Cartel methodology specifically targets credentials that fit this profile: long-lived, broadly scoped, low-visibility access mechanisms that enable significant blast radius once compromised.

The defender practice is comprehensive. Inventory every GitHub token issued in your organization. Document the scope, expiration, and operational purpose of each one. Rotate tokens on a documented schedule. Enforce minimum-necessary scopes. Use short-lived tokens issued just-in-time where possible. Use OIDC federation with cloud providers instead of long-lived GitHub-stored credentials for CI/CD authentication. Monitor for token usage patterns that deviate from documented operational purpose. The work is not glamorous. It is the kind of practitioner discipline that determines whether your organization is the next named victim or the one that fights off the same attack pattern.

INDICATORS AND TIMELINE

WHAT TO DO THIS WEEK