Heroku has now revealed that the stolen GitHub integration OAuth tokens from last month further led to the compromise of an internal customer database. BleepingComputer reports: The Salesforce-owned cloud platform acknowledged the same compromised token was used by attackers to exfiltrate customers’ hashed and salted passwords from “a database.” Like many users, we unexpectedly received a password reset email from Heroku, even though BleepingComputer does not have any OAuth integrations that use Heroku apps or GitHub. This indicated that these password resets were related to another matter. […]
In its quest to be more transparent with the community, Heroku has shed some light on the incident, starting a few hours ago. “We value transparency and understand our customers are seeking a deeper understanding of the impact of this incident and our response to date,” says Heroku. The cloud platform further stated that after working with GitHub, threat intel vendors, industry