Atlassian and Envoy briefly blame each other for data breach

Australian software giant Atlassian and Envoy, a startup that provides workplace management services, were at loggerheads on Thursday over a data breach that exposed the data of thousands of Atlassian employees.

As first reported by Cyberscoop, a hacking group known as SiegedSec leaked data on Telegram this week that it claimed to have stolen from Atlassian. This data includes the names, email addresses, work departments and phone numbers of approximately 13,200 Atlassian employees, along with floor plans of Atlassian offices located in San Francisco and Sydney, Australia.

“SiegedSec is here to announce that we have hacked the software company Atlassian,” SiegedSec said in a Telegram message seen by TechCrunch. “This company worth $44 billion has been pwned by the furry hackers uwu.” SiegedSec made headlines last year after it leaked eight gigabytes of data from the state governments of Kentucky and Arkansas, in protest at the states’ efforts to enact abortion bans following the Supreme Court’s decision to overturn Roe v. Wade.

Atlassian was quick to point the finger of blame for the breach at Envoy, which the Sydney-headquartered company uses to organize its office spaces. “On February 15, 2023, we learned that data from Envoy, a third-party app that Atlassian uses to coordinate in-office resources, was compromised and published,” Atlassian spokesperson Megan Sutton said in a statement shared with TechCrunch. “Atlassian product and customer data is not accessible via the Envoy app and therefore not at risk.”

Envoy, however, was just as quick to rebuff Atlassian’s claims. Envoy spokesperson April Marks told TechCrunch that the startup is “not aware of any compromise to our systems,” adding that initial research had shown that “a hacker gained access to an Atlassian employee’s valid credentials to pivot and access the Atlassian employee directory and office floor plans held within Envoy’s app.”

Soon after the startup’s denial, Atlassian changed its stance to align more closely with Envoy. Atlassian’s Sutton told TechCrunch that the company’s internal investigation since revealed that attackers had actually compromised Atlassian data from the Envoy app “using an Atlassian employee’s credentials that had been mistakenly posted in a public repository by the employee.”

“As such, the hacking group had access to data visible via the employee account which included the published office floor plans and public Envoy profiles of other Atlassian employees and contractors,” Sutton added. “The compromised employee’s account was promptly disabled eliminating any further threat to Atlassian’s Envoy data. Atlassian product and customer data is not accessible via the Envoy app and therefore not at risk.”

Envoy initially declined to answer our specific questions, but on Friday, the company’s spokesperson provided an update, ruling out a breach on its end.

“We found evidence in the logs of requests that confirms the hackers obtained valid user credentials from an Atlassian employee account and used that access to download the affected data from Envoy’s app,” said Envoy’s Marks.

While it appears that Envoy was not at fault for the Atlassian data breach, the workplace management startup — which counts a number of big-name customers, including Hulu, Pinterest, Slack and Stripe — is no stranger to security incidents. In 2019, security researchers at IBM uncovered two flaws in Envoy’s visitor management system that could have exposed customer data.

Updated with Envoy comment.