Summary
- Environment: Logging provider and GPU browser-session infrastructure
- Operational impact: Logging secrets downloaded; four servers accessed
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 5, 2026; updated as evidence emerges.
What happened
Impact
Three servers ran customer browser sessions; the fourth was a development server without customer data. Kernel reported 0.28% of customers affected, without publishing a customer count. [1]
Timeline
Logging data downloaded
Logging data downloaded, as described in the incident notice.
[1]Incident detected
Incident detected, as described in the incident notice.
[1]Hosting servers accessed and isolated
Hosting servers accessed and isolated, as described in the incident notice.
[1]Public notice issued
Public notice issued, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 5, 2026.
Threat Group & Attack Vector
The key was used on October 24 and to reach a logging-provider staff login on October 27. On November 3, a compromised hosting-account credential enabled access to four GPU servers. [1]
A cryptominer ran on the development server, with further starts attempted on other servers. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts. [1]
- T1496 — Resource Hijacking. [1]
Response
Kernel detected the incident on November 2, revoked credentials, removed access, isolated servers and notified exposed organizations. Response and recovery work continued through November 4. [1]