GitBook Reports 3-Hour-25-Minute Production Breach; SlowMist Says Trade.xyz Was Target

GitBook said in a November 2 incident review that attackers gained access to its production environment for about 3 hours and 25 minutes. According to Odaily, SlowMist Chief Information Security Officer 23pds identified Trade.xyz as the target. The attackers exploited a flaw in the single sign-on process to forge an employee session, used misconfigured GitHub App credentials to access an internal code repository, and obtained a Cloudflare API key. GitBook disabled the affected service accounts within hours, took the platform offline for about 16 hours, and restored it fully at 11:56 UTC on November 3. GitBook rotated infrastructure and hosted-customer keys and invalidated API tokens. Because attackers may have accessed customer data, the company treated all customer data as potentially exposed, including API tokens, integration keys, session-signing keys, assistant Q&A records, and permissions for authorized GitHub and GitLab apps. Billing information, passwords, and IP addresses were not affected. GitBook said available evidence indicates the attack focused on one customer, no other customer content was found to have been altered, and the attackers relied heavily on automation and AI.