SiegedSec threat group leaked data that Atlassian says was taken from app used to coordinate in-office resources.

Dark Reading Staff, Dark Reading

February 16, 2023

1 Min Read
Image of an Atlassian app on a mobile phone in front of a backdrop with the company logos
Source: Igor Golovnov via Alamy Stock Photo

Ed. note: This story has been updated to include a statement from Envoy provided to Dark Reading about the incident.

A threat group called SiegedSec recently posted a cache of employee and operations information allegedly stolen from software workforce collaboration tool provider Atlassian.

Now Atlassian, best known for its Trello, Jira, and Confluence brands, is reassuring its customers their data is secure, and according to reports, explained that a third-party app was breached, compromising employee data including names, emails, departments, and floor plans of segments of Atlassian offices located in San Francisco, Calif., and Sydney, Australia.

"Both Envoy and Atlassian security teams have been collaborating to identify the source of the data compromise," an Envoy spokesperson tells Dark Reading. "We found evidence in the logs of requests that confirms the hackers obtained valid user credentials from an Atlassian employee account and used that access to download the affected data from Envoy’s app. We can confirm Envoy’s systems were not compromised or breached and no other customer’s data was accessed."

The company statement added that there is an ongoing investigation into the breach.

Envoy says the breach likely occurred due to the threat actor gaining access to employee credentials.

"We’re investigating this right now and are not aware of any compromise to our systems,” an Envoy spokesperson said in a statement emailed provided to Dark Reading. “Our initial research shows that a hacker gained access to an Atlassian employee's valid credentials to pivot and access the Atlassian employee directory and office floor plans held within Envoy’s app.”

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights