Someone stole a GitHub access token from Grafana, downloaded the entire codebase, and then tried to extort the company with it. That's the short version. The longer version is instructive for any engineering org that uses GitHub as its source-of-record.

Grafana published a post-incident disclosure confirming that an unauthorised party obtained a token with access to its GitHub environment. The attacker used that access to clone the company's repositories — the full codebase. They then approached Grafana apparently seeking payment, using the stolen code as leverage. Grafana has said no customer data or personal information was accessed, and there's no evidence of downstream impact to customer systems.

Why this matters more than a typical source-code leak. Grafana isn't some niche tool. It's the dashboarding and observability platform sitting inside the monitoring stack of a huge chunk of the world's infrastructure — enterprise data centres, cloud platforms, government networks, hospitals. In Australia, Grafana is embedded in everything from large financial services shops to health agencies running on AWS or Azure. If an attacker had found something exploitable in that source code before Grafana could audit and rotate, the blast radius could have been significant.

The good news is that source-code theft without a corresponding supply-chain injection is materially different from a compromise of build pipelines or release artifacts. What Grafana's users are actually running hasn't been shown to be tampered with. That's the key distinction — and it's one every organisation in the supply chain should be verifying independently right now by checking their Grafana versions and build provenance.

The extortion angle is increasingly common. Attackers who get hold of source code but can't immediately monetise it through a vulnerability are increasingly turning to extortion as the revenue path. We've seen this with the GitHub token-theft wave that hit multiple companies over the past two years, and it points to a structural problem: GitHub tokens are often long-lived, widely shared across CI/CD systems, and rarely rotated on a schedule.

What to watch. Grafana hasn't yet detailed exactly how the token was obtained — whether through a phishing attack, a compromised developer endpoint, a leaked secret in a CI/CD log, or something else. That disclosure will matter. Token hygiene is the immediate takeaway: audit your GitHub personal access tokens and OAuth apps now, enforce short expiry windows, and make sure your CI/CD secrets aren't logging to places humans can read.

For Australian organisations, this incident also touches SOCI Act obligations around supply-chain risk management. If Grafana is part of your observability stack for critical infrastructure, third-party risk assessments should already cover this vendor. If they don't, now's the time to close that gap — not after an attacker finds something useful in that codebase before you do.