IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Rapid7 says its source code was accessed after CodeCov hack

Cyber criminals gained access to code used for internal tooling and its flagship detection and response service

Cyber security firm Rapid7 has revealed that a cyber attack against its supplier CodeCov led to hackers accessing a subset of its source code repositories.

The code coverage platform CodeCov suffered an incident last month in which attackers broke through its defences and modified its Bash Uploader script, meaning hundreds of clients who executed the script may have also been compromised.

Rapid7, which uses the service, confirmed it was among the string of companies whose networks were infiltrated due to the attack. The cyber criminals accessed source code used for the firm’s internal tooling as well as its managed detection and response (MDR) service.

MDR is a set of capabilities that Rapid7 markets as being able to detect advanced threats and stop attackers while infiltration attempts are in process. Part of the package includes threat hunting, 24/7 monitoring, as well as rapid incident response.

The source code repositories accessed also contained internal company credentials, which have all been rotated, and alert-related data for a portion of MDR customers. Rapid7 has said it has contacted any customers that may be affected.

Codecov develops auditing tools that clients can use to see how thoroughly their own code is being tested, which may give this tool access to credentials for internal software accounts.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

Following the breach, the FBI feared that the attackers used an automated system to copy those credentials and raid additional resources, according to Reuters.

IBM was also among the companies to have revealed they were using Codecov, although a spokesperson told the publication at the time that they had found no modifications of code involving IBM or its clients.

The hack, described as a supply chain attack, is eerily similar in nature to both the SolarWinds Orion attack in late 2020 and the Microsoft Exchange Server breach earlier this year. These are considered among the worst security incidents in recent months, and both saw potentially thousands of businesses compromised after the systems of their supplier, in each case, was breached.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
61% of organizations say improving security a top priority for 2021
cyber security

61% of organizations say improving security a top priority for 2021

29 Jun 2021

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022
Swift exit: How the world cut off Russian banks
finance

Swift exit: How the world cut off Russian banks

24 Jun 2022