SiegedSec exposes Atlassian data leaked via third-party app

Notorious threat group SiegedSec exposed the data of employee and operations information on Telegram, stolen from Australian software workforce collaboration tool provider Atlassian, best known for its Trello, Jira, and Confluence brands.

The company has reassured its customers that their data is secure and explained that a third-party app used by workplace management company Envoy to coordinate in-office resources was breached, compromising employee data, including names, emails, departments, and floor plans of segments of Atlassian offices located in San Francisco, Calif., and Sydney, Australia.

Although Atlassian blamed Envoy for the data breach, Envoy snubbed Atlassian’s claims stating that the initial research showed that a hacker gained access to an Atlassian employee’s valid credentials to pivot and access the Atlassian employee directory and office floor plans held within Envoy’s app.

Soon after the startup’s denial, Atlassian’s spokesperson confirmed that the company’s internal investigation revealed that attackers had compromised Atlassian data from the Envoy app “using an Atlassian employee’s credentials that had been mistakenly posted in a public repository by the employee.

It also confirmed that Envoy’s systems were not compromised or breached, and no other customer’s data was accessed. Envoy and Atlassian security teams are collaborating to identify the source of the data compromise.