Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Vulnerability and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an enhanced monitoring with real-time threat intelligence, enhanced monitoring with advanced monitoring, and remediation measures with manual device recovery, system reboots, and remediation measures with preventing process suspension, and and third party assistance with npm registry collaboration, and containment measures with removal of malicious packages from npm registry, containment measures with key rotation in public registries, and remediation measures with audit of environments/developer machines, remediation measures with credential rotation (npm tokens, cloud credentials), remediation measures with monitoring for unauthorized publishes, and recovery measures with pinning to known-good package versions, recovery measures with awaiting patched releases, and communication strategy with public statement via gbhackers on security, communication strategy with collaboration with npm for technical analysis, and enhanced monitoring with logs for unusual npm/github activity, and and and containment measures with termination of insider access, containment measures with revocation of compromised credentials, and communication strategy with public statement, communication strategy with media engagement..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Phishing Email, compromised npm packages (e.g., @crowdstrike/commitlint, @crowdstrike/falcon-shoelace) and Insider (Terminated Employee).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer Information, Proprietary Data, Secrets, Api Keys, Cloud Credentials, Github Tokens, , Internal Screenshots, Authentication Cookies (Attempted) and .

Third-Party Assistance: The company involves third-party assistance in incident response through npm registry collaboration, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Manual device recovery, system reboots, Preventing process suspension, , audit of environments/developer machines, credential rotation (npm tokens, cloud credentials), monitoring for unauthorized publishes, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by removal of malicious packages from npm registry, key rotation in public registries, , termination of insider access, revocation of compromised credentials and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through pinning to known-good package versions, awaiting patched releases, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Law Enforcement Investigation, .

Key Lessons Learned: The key lessons learned from past incidents are The incident underscores the continuous threats faced by cybersecurity providers and the importance of adopting a comprehensive cybersecurity strategy that includes real-time threat intelligence, advanced monitoring, and the implementation of a Zero Trust architecture to reduce the risk of such attacks.Supply chain attacks via open-source dependencies pose significant risks even to security-focused organizations.,Post-install scripts in npm packages can be weaponized for credential theft.,Proactive key rotation and environment audits are critical after such incidents.Importance of insider threat monitoring, rapid credential revocation, and proactive dark web intelligence to mitigate leaks from disgruntled or compromised employees. Highlights the growing collaboration among cybercriminal groups (e.g., Scattered Lapsus$ Hunters) in extortion campaigns.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: GBHackers on Security, and Source: Socket.dev, and Source: CrowdStrike Official Statement, and Source: Media Reports on Scattered Lapsus$ Hunters Activity.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Statement Via Gbhackers On Security, Collaboration With Npm For Technical Analysis, Public Statement and Media Engagement.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Crowdstrike Spokesperson Statement Confirming Removal Of Malicious Packages And Key Rotation, Audit Environments For Unauthorized Activity., Rotate Secrets And Monitor For Suspicious Publishes., , CrowdStrike reassured customers that no systems or customer data were compromised. and No action required for customers; incident contained internally..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Real-Time Threat Intelligence, Advanced Monitoring, , Npm Registry Collaboration, , Logs For Unusual Npm/Github Activity, .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Enhanced Security For Npm Publishing Accounts., Automated Scanning For Malicious Post-Install Scripts., Improved Incident Response For Supply Chain Attacks., , Termination Of Malicious Insider, Enhanced Monitoring Of Privileged User Activities, Review Of Access Controls For High-Value Internal Data, Proactive Threat Hunting For Scattered Lapsus$ Hunters-Related Activity, .

Last Attacking Group: The attacking group in the last incident was an Scattered Lapsus$ HuntersShinyHuntersScattered Spider.

Most Recent Incident Detected: The most recent incident detected was on 2025-01-07.

Most Significant Data Compromised: The most significant data compromised in an incident were Customer Information, Proprietary Data, developer secrets, API keys, cloud credentials, GitHub tokens, , Internal Screenshots, SSO Authentication Cookies (Attempted) and .

Most Significant System Affected: The most significant system affected in an incident was Falcon Sensor and developer machinesCI/CD pipelinesGitHub repositories.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was npm registry collaboration, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were removal of malicious packages from npm registrykey rotation in public registries and Termination of Insider AccessRevocation of Compromised Credentials.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were SSO Authentication Cookies (Attempted), Internal Screenshots, developer secrets, GitHub tokens, API keys, cloud credentials, Customer Information and Proprietary Data.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Law Enforcement Investigation, .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Proactive key rotation and environment audits are critical after such incidents., Importance of insider threat monitoring, rapid credential revocation, and proactive dark web intelligence to mitigate leaks from disgruntled or compromised employees. Highlights the growing collaboration among cybercriminal groups (e.g., Scattered Lapsus$ Hunters) in extortion campaigns.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement stricter vetting for open-source dependencies., Rotate all potentially exposed credentials (npm, GitHub, cloud)., Conduct regular security awareness training on social engineering risks (e.g., voice-phishing)., Implement stricter access controls and just-in-time (JIT) privilege escalation., Monitor dark web/Telegram channels for leaked credentials or internal data., Enhance insider threat detection programs with behavioral analytics., Monitor for unauthorized npm publishes or GitHub Actions workflows., Strengthen collaboration with law enforcement for threat actor disruption., Uninstall compromised npm packages or pin to pre-attack versions. and Use tools like `npm audit` and dependency scanners to detect malicious packages..

Most Recent Source: The most recent source of information about an incident are GBHackers on Security, Media Reports on Scattered Lapsus$ Hunters Activity, Socket.dev and CrowdStrike Official Statement.

Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (collaboration between CrowdStrike and npm).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was CrowdStrike spokesperson statement confirming removal of malicious packages and key rotation, CrowdStrike reassured customers that no systems or customer data were compromised., .

Most Recent Customer Advisory: The most recent customer advisory issued were an Audit environments for unauthorized activity.Rotate secrets and monitor for suspicious publishes. and No action required for customers; incident contained internally.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Phishing Email, compromised npm packages (e.g., @crowdstrike/commitlint, @crowdstrike/falcon-shoelace) and Insider (Terminated Employee).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Compromise of CrowdStrike's npm publisher account.Insufficient vetting of post-install scripts in dependencies.Trust in open-source supply chain exploited., Insider abuse of access privilegesInadequate monitoring of credential exfiltration attemptsLack of real-time dark web monitoring for leaked internal data.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Enhanced security for npm publishing accounts.Automated scanning for malicious post-install scripts.Improved incident response for supply chain attacks., Termination of malicious insiderEnhanced monitoring of privileged user activitiesReview of access controls for high-value internal dataProactive threat hunting for Scattered Lapsus$ Hunters-related activity.