Sumo Logic AWS account accessed with a compromised credential
On November 3, 2023 Sumo Logic found that a compromised credential had been used to access one of its AWS accounts. It locked down the infrastructure, rotated potentially exposed credentials and on November 7 told customers to rotate Sumo Logic API access keys and other credentials as a precaution, later narrowing the advice. The company did not say how the credential was obtained.
- Victim
- Sumo Logic
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Nov 2023
- First disclosed
- Nov 7, 2023
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Credential storage
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Cloud account credentials need the same short lifetimes and anomaly monitoring as user logins; a single unrotated credential forced every customer to rotate their own keys.
Sources
- Security response center, Sumo Logic, Nov 20, 2023
- Sumo Logic discloses potential breach via compromised AWS credential, Help Net Security, Nov 8, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- Nikkei Slack workspace accessed with credentials stolen by malware 2025 · Stolen credentials
- Disney Slack data theft using credentials stolen from an employee's personal computer 2024 · Stolen credentials
- Dropbox Sign production breach via a compromised service account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Sumo Logic AWS account accessed with a compromised credential. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-sumo-logic-aws-credential-compromise/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.