Grafana Suffers Data Breach Following TanStack Supply Chain Attack
Grafana experienced a breach due to a missed GitHub workflow token rotation after the TanStack npm supply-chain compromise. The incident was reported May 20. It allowed unauthorized access tied to the earlier attack vector.
- credentials
- internal data
Grafana disclosed a data breach on May 20, 2026, after attackers leveraged a missed GitHub workflow token rotation that stemmed from the earlier TanStack npm supply-chain compromise. The incident exposed credentials and internal data, although the precise number of affected users remains unknown.
Public reporting indicates the breach occurred because Grafana failed to rotate a GitHub workflow token following the TanStack attack. This oversight allowed unauthorized access that was directly tied to the earlier supply-chain vector. The company confirmed that both credentials and certain internal data were accessed during the incident.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary DoxxScan™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15B+ leaked records (including this breach) in 15 seconds — then show you the $14.99 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
