Grafana Labs, the company behind the open source web visualization tool that has become a darling of dashboard enthusiasts everywhere, has confirmed it was hacked - and that it will not be paying the ransom, because the code in question was, in a plot twist, already open source.
In a series of social media posts that read like a cybersecurity incident report written by someone who has seen this movie before, the company revealed that a stolen token credential gave hackers access to its GitLab environment. The token did not grant access to customer records or financial data, but it did allow the hackers to download the company's source code repositories. Grafana has since invalidated the token and added additional security measures, because nothing says "lesson learned" like a password reset and a stern memo.
"The attacker attempted to blackmail us, demanding payment to prevent the release of our codebase," the company stated, presumably with a sigh and a slow blink. Given that Grafana's code is open source and publicly available for anyone to download, edit, and run on their own machines, the blackmail threat is about as effective as threatening to reveal that a magician's assistant was in on it the whole time. It remains unclear if the hackers stole any proprietary code or information, but the company's spokesperson did not immediately return a request for comment, likely because they were too busy trying to find a polite way to say "we're not paying for a service we already provide for free."
This incident stands in stark contrast to the recent hack at education tech giant Instructure, which last week "reached an agreement" to pay hackers who had compromised its network twice in recent weeks. Instructure's hackers demanded an unspecified ransom, threatening to release stolen data about staff and students after a massive data breach and a subsequent website defacement. Grafana, however, cited the FBI's long-standing advice urging victims not to pay hackers, because cooperating with criminals is about as reliable as a free Wi-Fi connection at an airport. Critics also note that paying cybercriminals just funds future attacks, which is like giving a mugger your wallet so they can buy a better crowbar.
Grafana said its investigation is ongoing and will share its findings once complete - presumably in a public repository, because at this point, why not?