Security Breach in JetBrains Cadence: Customer Data Compromised
Unauthorized access detected in cloud project execution service.
1Incident Scope
JetBrains confirmed a security breach in its cloud-based project execution service Cadence between August 8-24, 2026. Attackers exploited the CVE-2026-63077 vulnerability in TeamCity to gain unauthorized access to customer data. Compromised information includes usernames, real names, email addresses, and login records. The company detected the breach on August 23 and shut down the affected server on August 24.
2Vulnerability Source
The attack originated from a critical security flaw in JetBrains' CI/CD solution TeamCity. Designated as CVE-2026-63077, this vulnerability allows arbitrary command execution without authentication. JetBrains verified that Cadence was running an affected TeamCity version. Exploiting this weakness, attackers successfully infiltrated Cadence environments and exfiltrated data.
3Affected Systems
The breach primarily impacted the api.cadence.jetbrains.com server. Attackers accessed AWS IAM credentials of JetBrains employees and viewed files in the company's S3 storage. A complete 2024 server backup was also compromised. JetBrains emphasized that all credentials and configurations in this backup are now potentially exposed.
4Immediate User Actions
JetBrains advises Cadence users to immediately revoke and rotate all credentials. Users should check AWS accounts, S3 buckets, deployment environments, and package registries for suspicious activity. Additionally, they must review source code repositories for unauthorized changes and update sensitive information in files synchronized from PyCharm.
5Compromise Indicators
The company identified attacker IPs including 150.109.230.104 and 43.153.227.206, with activity dating back to August 8. Other red flags include unexpected repository clones, unauthorized commits, cloud IAM role modifications, and repository secret alterations. Users should monitor connections from these IPs and inspect unexpected cloud storage access.
6Data Breach Consequences
Stolen personal data risks being used in targeted phishing, social engineering, and impersonation attacks. Particularly, email addresses and real names could facilitate malicious communications. JetBrains notified affected users directly, recommending additional security measures to mitigate potential threats.
7Industry Implications
This incident reignites concerns about cloud-based development tool security. Experts highlight how CI/CD system vulnerabilities can cause widespread breaches. Companies are urged to review third-party integrations and backup policies. While JetBrains' rapid response is praised, the full scope remains unclear, underscoring systemic challenges in cloud service security.
8Next Steps
JetBrains continues its investigation and promises updates. Users must treat all Cadence executions as untrusted and report suspicious activity. The company is still determining whether attackers accessed customer storage buckets. Meanwhile, industry-wide patching of the TeamCity vulnerability remains critically urgent to prevent similar incidents.