Online collaboration tool Monday.com has acknowledged that cybercriminals accessed a read-only copy of its source code.
Monday.com is an project management platform that counts the likes of Uber, BBC Studios, Adobe, Universal, Hulu, L’Oreal, Coca-Cola, and Unilever as customers.
The platform is one of a growing list of targets that has fallen prey to a supply-chain attack on software auditing company Codecov last month.
We’re looking at how our readers use VPN for a forthcoming in-depth report. We’d love to hear your thoughts in the survey below. It won’t take more than 60 seconds of your time.
Unauthorized users modified Codecov’s bash uploader script and used it for several months to siphon off credentials of its customers, one of them being Monday.com.
“While we have seen evidence that our source code was accessed due to the Codecov vulnerability, to date, we have found no evidence of any unauthorized modifications to our source code, or any impact on our products,” wrote Monday.com in a blog post last week, outlining their response to the Codecov incident.
The company was forced to reveal the news in documents filed with the U.S. Securities and Exchange Commission (SEC) as it prepares a stock exchange listing in the country.
Supply chain victims
Monday.com is just one in the string of Codecov customers that has been compromised by the Codecov attackers in typical supply-chain attack fashion.
Last month, an anonymous investigator from the FBI’s San Francisco office told Reuters that the Codecov attackers put extra effort to break into the software auditing company that has thousands of customers, in order to infiltrate other “makers of software development programs” as well as companies that themselves provide many customers with technology services.
In addition to Monday.com, reports suggest that cybersecurity firm Rapid7, software developers HashiCorp, cloud communications platform Twilio, cloud services provider Confluent, and insurance company Coalition, have all been affected by the Codecov breach in some way.
Via BleepingComputer
