CircleCI engineer session token theft and customer secrets exposure
Malware on a CircleCI engineer's laptop, undetected by antivirus, stole a valid SSO session cookie that was already backed by 2FA. Using that session, the attacker reached production systems between December 19 and December 22, 2022, and exfiltrated customer environment variables, tokens and keys, along with the encryption keys needed to read them. CircleCI disclosed on January 4, 2023 and told every customer to rotate all secrets.
- Victim
- CircleCI
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Dec 16, 2022
- First disclosed
- Jan 4, 2023
- Actor
- Unattributed
- Initial access
- Session or token theft
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
MFA protected the login, not the session that followed it. Short-lived, device-bound sessions for production access and treating stored customer secrets as tier-zero would have limited what one stolen cookie could reach.
Go deeper on SWI
- Technique: Session cookie theft
Sources
- CircleCI incident report for January 4, 2023 security incident, CircleCI, Jan 13, 2023
- Security alert: January 4, 2023, CircleCI, Jan 4, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Electronic Arts source code theft via purchased Slack cookie 2021 · Session or token theft
- Slack private GitHub repositories downloaded with stolen employee tokens 2022 · Session or token theft
- Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions 2025 · Session or token theft
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). CircleCI engineer session token theft and customer secrets exposure. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-circleci-engineer-session-token-theft/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.