Bitrise restores limited access after internal system breach

Bitrise said it detected suspicious activity in an internal cloud environment at 16:32 UTC on 13 November and confirmed unauthorised access to an internal system.CyberSIXT The company said the system does not store or process customer data and that it has found no evidence that customer data, secrets or source code were exposed.CyberSIXT Bitrise shut down all services as a precaution, and its status page listed the incident as SEV-1, affecting all services and users.CyberSIXT

On Saturday, Bitrise restored app.bitrise.io in a limited safety mode that lets users review connected Git accounts, secrets, certificates and tokens, and rotate or revoke them, while most features remain unavailable.CyberSIXT Bitrise said it shut down and rotated its own platform secrets within minutes of detecting signs of a live attack, and that it was still restoring build infrastructure.CyberSIXT The company has not said how the attacker gained access, how long access lasted or whether anything connected to customer builds was reached.CyberSIXT

Coinone said attackers accessed servers belonging to MetaM, the outside company that runs its customer support, at about 04:00 Korean time on 12 November and viewed or took stored support records.CyberSIXT The records may include information customers supplied in chats or calls, including passwords, resident registration numbers, bank account numbers, names, addresses, wallet addresses and transaction IDs; the information varies by customer.CyberSIXT Coinone said only customers who contacted its support centre are affected, but it has not stated how many people are involved.CyberSIXT

Coinone said its member accounts, trading system and crypto wallets operate separately from MetaM’s servers and that it has found no sign of a direct intrusion into them.CyberSIXT The exchange said the exposed information alone cannot be used to log in or withdraw funds because logins also require OTP or KakaoTalk verification on the customer’s phone.CyberSIXT

Ryohin Keikaku said about 1.09 million MUJI Card numbers may have been accessed in its breach, with the affected cards opened between October 2000 and July 2021 and about 345,000 still valid.CyberSIXT The company had retained the unmasked numbers after changing its customer identification system in July 2021; the exposed records also include MUJI Card IDs and dates of birth, but not cardholder names, expiry dates or security codes.CyberSIXT

The disclosure followed Ryohin Keikaku’s 30 October notice that email addresses, dates of birth and genders of up to 27.26 million MUJI app members might have been exposed.CyberSIXT The company later said about 750,000 records included names, addresses and phone numbers, and that names and postcodes of about 440,000 people who received cash-on-delivery orders between January 2020 and February 2025 may also have been exposed.CyberSIXT Its online store has been shut since 6 November, with no reopening date announced.CyberSIXT