Blacksmith says an unauthorized party accessed the system holding console logs from its continuous integration (CI) runners. The company reported the incident on November 6, a day after it says its security team detected and contained the access.
The provider says job-log data belonging to approximately 2.6% of customer accounts was impacted. It says it contacted each affected customer with organization-specific details. That percentage is Blacksmith’s estimate of affected accounts, not a measure of exposed jobs or stolen credentials.
Evidence status: Blacksmith confirms unauthorized access to its log store. It says it revoked that access on November 5 and blocked a later attempt to regain entry. The notice says CI execution was unaffected and that the company has no evidence of exposure beyond the log store. Its investigation continues.
Check what a job could have printed
CI logs can contain build output, diagnostic messages and, sometimes, credentials accidentally printed by a job. Blacksmith’s notice does not say whether secrets were present, which jobs were viewed, or whether any particular credential was misused.
Blacksmith says customers outside the notified group do not need to act on this incident. An affected organization should use the provider’s direct notification to identify the relevant logs and follow its incident-specific guidance. If a log contains a credential that could have been exposed, revoke or rotate it and review the associated access records where available.
For any CI system, reducing secret output and limiting credential lifetime can make future log exposure less damaging. Masking is useful, but should not be assumed to catch every way a secret can appear in output.
Caveat: Blacksmith has not yet published a full incident report; the entry route, duration and detailed scope remain undisclosed.