Sisense breach exposing customer credentials, prompting a CISA alert
In April 2024 analytics vendor Sisense told customers to rotate credentials, and CISA issued an alert after independent researchers and CISA found compromised Sisense data affecting critical infrastructure organizations. KrebsOnSecurity, citing sources, reported that attackers reached Sisense's self-managed GitLab, where a hard-coded token gave access to Amazon S3 buckets holding customer access tokens, passwords and certificates. Sisense did not publicly confirm the access path.
- Victim
- Sisense
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Apr 11, 2024
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Credential storage
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A vendor that stores customers' integration secrets concentrates risk. Keeping tokens out of code, scoping cloud keys narrowly and favoring short-lived federated credentials over stored passwords would have limited the blast radius.
Regulatory and legal outcome
CISA issued an alert on April 11, 2024 urging Sisense customers to reset credentials and secrets potentially exposed to or used to access Sisense services.
Go deeper on SWI
- Technique: Secrets in repositories and CI
Sources
- Compromise of Sisense customer data, CISA, Apr 11, 2024
- Why CISA is warning CISOs about a breach at Sisense, KrebsOnSecurity, Apr 11, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys 2026 · Exposed secrets
- Internet Archive user database theft and Zendesk token abuse 2024 · Exposed secrets
- New York Times source code stolen with an exposed GitHub credential 2024 · Exposed secrets
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). Sisense breach exposing customer credentials, prompting a CISA alert. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-sisense-gitlab-token-customer-credentials/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.