The production environment was compromised for approximately 3 hours and 25 minutes, and GitBook disclosed that the attack target was Trade.xyz

Odaily reports: GitBook released a post-incident review of the November 2 security breach, stating that the attacker exploited a vulnerability in the single sign-on flow to forge an employee session, gained access to internal code repositories through improperly configured GitHub App credentials and obtained Cloudflare API keys, ultimately acquiring production environment access. GitBook disabled the relevant service accounts within hours, took the platform offline for approximately 16 hours, and fully restored services at 11:56 UTC on November 3; the attacker remained in the production environment for approximately 3 hours and 25 minutes.

GitBook has rotated infrastructure and hosted customer keys and revoked API tokens. Since the attacker may have accessed customer data within the platform, GitBook is treating all customer data as potentially exposed, including API tokens, integration keys, session signing keys, assistant Q&A records, and GitHub and GitLab app permissions for authorized repositories; billing information, passwords, and IP addresses were not affected. GitBook stated that current indications suggest the attack was targeting a single customer, with no evidence of other customers' content being tampered with, and that the attack was highly reliant on automation and AI. SlowMist Chief Information Security Officer 23pds stated that the target was Trade.xyz.