Update:
GitBook security incident update Hey <$name>, The GitBook app, the GitBook API, and published docs are available again. A few services may still be degraded as we finish restoring everything to full performance.
*What happened* GitBook has been the target of a sophisticated, highly targeted attack using AI agents. At 19:00 CET, November 2, the attacker gained unauthorized access to some of our infrastructure credentials. We detected the attack immediately and acted swiftly to block further impact. To make sure our infrastructure was fully secure, we then took the GitBook app and authenticated docs sites offline. We kept publicly published content live for as long as possible, using cached data.
*What we did immediately* * Blocked the attacker and closed the vulnerabilities involved * Replaced every credential and secret across our infrastructure * Brought services back only once we were confident they were secure * Invalidated every customer’s API tokens on our platform
*Your data* Our investigation shows that the attacker may have accessed the following: * Git Sync secrets. * GitBook API tokens. * Third-party API tokens used to connect external tools to GitBook. * Questions asked to GitBook Assistant by your site visitors.
At this stage, we have found no evidence that any of your content in GitBook was modified.
*What you need to do now* * Rotate any existing GitBook API tokens. We revoked all personal API tokens during the incident. * Rotate any third-party API tokens or secrets you use to connect other tools to GitBook. * If you have published integrations that use secrets, rotate those secrets. * If you use the GitBook MCP server, re-authenticate it. Please contact your GitBook organization’s admin to assist with this process.
*What we are doing next* * Monitoring the situation in case of further attacks. * Introducing further security measures to our platform. * Writing a full post mortem that will be published soon with more detailed information about the incident. * If you have any further questions, please reach out to your account manager or our support team. You can also check status.gitbook.com for updates
Thank you for your patience, and we apologize again for the disruption The GitBook team
Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above.
https://validator.w3.org/nu/?doc=https%3A%2F%2Fwww.gitbook.c...
And images that are 4x larger than necessary on the main page (nevermind whether the images add value to begin with):
https://webspeedtest.cloudinary.com/results/261104_YiDc1V_1W
There are maybe 10 websites that look good "inside and out" because web design is a broken field run by non-technical people.
The actual status page appears to be hosted on incident.io https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...
Thanks for the honest answer, nonetheless. Good luck with the incident.
Add it to the list, I guess.
Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents.
We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.
Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.
We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.
With the spate of attacks on infra providers over the past few weeks, it's been interesting to see how different competitors respond. The confidence some of the founders seem to have that they won't/can't be next is telling.
Good work.
it is sort of funny to see this on a post submitted by a gitbook user that starts off by saying "We have yet to see any official customer communication or breach notification.", and where the company's status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...) doesn't mention the customer data that was potentially accessed by the attackers or mention that credentials/tokens should be rotated.
in fact, that status page (which is linked to at the top of the gitbook site) still says "You don’t need to do anything right now."
Serious question: How do you know it was using AI agents? What logs distinguish it from a human?
I see this claim a lot and while I don't doubt AI is being used for this, I have a hard time believing every breach has a smoking gun showing it to be an AI assisted attack.
Feels like a new normal
"the attacker gained unauthorized access to some of our infrastructure credentials"
How? Which infrastructure?
I love the way all incident reports tell you the attack was sophisticated and highly targeted, as if those words actually mean anything. Nobody wants to admit they were DDOSed by a script kiddie just randomly trying exploits. The subtext is: well, we expected hackers; just not really good ones.