Online collaboration tool Monday.com (opens in new tab) has acknowledged that cybercriminals accessed a read-only copy of its source code.
Monday.com is an project management platform that counts the likes of Uber, BBC Studios, Adobe, Universal, Hulu, L'Oreal, Coca-Cola, and Unilever as customers.
The platform is one of a growing list of targets that has fallen prey to a supply-chain attack (opens in new tab) on software auditing company Codecov (opens in new tab) last month.
- These are the best online collaboration tools
- Check our collection of the best endpoint protection tools
- Here's our choice of the best malware removal software on the market
Unauthorized users modified Codecov’s bash uploader script and used it for several months to siphon off credentials of its customers, one of them being Monday.com.
“While we have seen evidence that our source code was accessed due to the Codecov vulnerability, to date, we have found no evidence of any unauthorized modifications to our source code, or any impact on our products,” wrote Monday.com in a blog post last week, outlining their response to the Codecov incident.
The company was forced to reveal the news in documents filed with the U.S. Securities and Exchange Commission (SEC) as it prepares a stock exchange listing in the country.
Supply chain victims
Monday.com is just one in the string of Codecov customers that has been compromised by the Codecov attackers in typical supply-chain attack fashion.
Last month, an anonymous investigator from the FBI's San Francisco office told Reuters (opens in new tab) that the Codecov attackers put extra effort to break into the software auditing company that has thousands of customers, in order to infiltrate other “makers of software development programs” as well as companies that themselves provide many customers with technology services.
In addition to Monday.com, reports suggest that cybersecurity (opens in new tab) firm Rapid7, software developers HashiCorp, cloud communications (opens in new tab) platform Twilio (opens in new tab), cloud services provider (opens in new tab) Confluent, and insurance company Coalition, have all been affected by the Codecov breach in some way.
- Protect your devices with these best antivirus software (opens in new tab)
Via BleepingComputer (opens in new tab)
