GitBook Suffers Security Breach Involving Unauthorized Access to Infrastructure Credentials

Incident Details

On November 2, at 19:00 CET, GitBook was targeted by a sophisticated attack. An attacker gained unauthorized access to some of GitBook's infrastructure credentials. The company detected the breach immediately and took action to block further impact.

Service Disruption and Restoration

Following the detection, GitBook took its app and authenticated documentation sites offline to ensure infrastructure security. Publicly published content remained live as long as possible using cached data. Services have since been restored, though some may still be degraded as full performance is re-established.

Data Potentially Accessed

GitBook's investigation indicates that the attacker may have accessed Git Sync secrets, GitBook API tokens, third-party API tokens used for external tool connections, and questions asked to GitBook Assistant by site visitors. As of the current investigation, there is no evidence that any user content within GitBook was modified.

Immediate Actions Taken by GitBook

GitBook blocked the attacker, closed identified vulnerabilities, and replaced all credentials and secrets across its infrastructure. The company only brought services back online after confirming their security. All customer API tokens on the platform were invalidated.

User Actions Required

Users are advised to rotate any existing GitBook API tokens, as all personal API tokens were revoked during the incident. Additionally, users should rotate any third-party API tokens or secrets used to connect other tools to GitBook, and re-authenticate the GitBook MCP server if used. Organization administrators are encouraged to assist with this process.

Next Steps

GitBook is monitoring for further attacks and plans to introduce additional security measures. A full post-mortem with more detailed information about the incident will be published soon. Users can check status.gitbook.com for updates or contact support for questions.