5 ms·
> Additionally, we have no evidence that the attacker has accessed any customer accounts or decrypted customers’ environment variables. Now the attackers had a
by ezekg 4y ago
> Additionally, we have no evidence that the attacker has accessed any customer accounts or decrypted customers’ environment variables.
Now the attackers had access to encrypted environment variables?
- ezekg 4y agoMore context, from the latest email notification: > We also wanted to address a question regarding impact to environment variables. While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets.
- BeefWellington 4y ago> and the threat actor did not access the encryption key necessary to decrypt config var secrets. If the threat actor had access to any of the systems that use the key, they may not have needed to. Even this statement isn't clear that they couldn't have done it, but suggests that they don't think it's true... This is really bad incident response messaging.
- remram 4y agoWhere do I find those notifications? I only got a single email, stating I should "reset my user password as mentioned in our previous notification". Nothing prior, nothing since, and their password reset form shows nothing but "Internal Server Error". I've been getting some details from HN but I think I'm missing a lot of the picture since they obviously don't send everyone every email.