Slack private GitHub repositories downloaded with stolen employee tokens
On December 27, 2022 an attacker used a limited number of stolen Slack employee tokens to access Slack's externally hosted GitHub repositories and download private code. Slack was notified of suspicious activity on December 29 and posted a security update on December 31, 2022; a January 2023 update said the tokens came from a compromised third-party vendor.
- Victim
- Slack (Salesforce)
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Dec 27, 2022
- First disclosed
- Dec 31, 2022
- Actor
- Unattributed
- Initial access
- Session or token theft
- Identity control that failed
- Session and tokens
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Long-lived developer tokens stored at third-party vendors are reusable credentials; short token lifetimes and IP or device binding make stolen tokens expire before they are used.
Sources
- Slack Security Update, Slack, Dec 31, 2022
- Slack's private GitHub code repositories stolen over holidays, BleepingComputer, Jan 4, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- CircleCI engineer session token theft and customer secrets exposure 2023 · Session or token theft
- Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions 2025 · Session or token theft
- Electronic Arts source code theft via purchased Slack cookie 2021 · Session or token theft
- Hijacked AI coding assistant session spreads Shai-Hulud inside a SaaS provider 2026 · Supply chain
Cite this record
SWI Community Team. (2026). Slack private GitHub repositories downloaded with stolen employee tokens. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-slack-github-stolen-tokens/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.