Stolen GitHub token downloaded Grafana code, extorted company

Grafana disclosed an unauthorized party used a stolen GitHub token to access its GitHub environment, download parts of the company’s codebase and demand payment. The company reported its investigation found no access to customer data, personal information or customer systems.

Upon discovery, Grafana launched a forensic investigation, revoked the compromised token and implemented additional security controls in its development environment. The company declined the extortion demand and cited guidance from the U.S. Federal Bureau of Investigation when choosing not to pay.

The FBI warns on its website that negotiating with extortionists “encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.”

Grafana did not disclose when the activity occurred, how long the token had been valid, or which repositories and products were accessed. The company noted it learned of the incident “recently” and has not attributed the theft to a known threat actor.

Security reporting indicates a cybercrime group calling itself CoinbaseCartel has claimed responsibility. Researchers tracking the group trace its activity to September 2025 and describe it as a data-extortion crew focused on stealing information and demanding payment rather than deploying traditional ransomware.

Analyses link CoinbaseCartel to actors associated with earlier data-theft groups and attribute roughly 170 victims to the group across healthcare, technology, transportation, manufacturing and business services.

Grafana provides observability tools and cloud-hosted services, including Grafana Cloud. The company did not confirm whether code for specific products or services was among the materials downloaded and said it will continue forensics and remediation to secure its development environment.

Days earlier, education-technology company Instructure settled with an extortion group after threats to publish terabytes of data from thousands of schools and universities. Security observers note that access via exposed or stolen developer credentials remains a common method for obtaining source code and other intellectual property.