GitBook breach: all customer data treated as exposed

Your docs platform holds more secrets than your docs. The GitBook breach shows it. An attacker used a flaw in GitBook's SSO login, became GitBook staff, and reached production in about five hours. GitBook took the app offline for about 16 hours and now treats all customer data as exposed. If you publish docs on GitBook, you have rotation work to do.

What actually happened in the GitBook breach

GitBook's incident report, signed by its CEO and CTO, gives the timeline in UTC:

• November 2, 12:27. The first account is hijacked at one targeted customer.
• 16:32. A flaw in the SSO login flow lets the attacker create sessions as GitBook staff. A misconfigured GitHub App in GitBook's own organization then gives access to internal source code.
• 17:48. The attacker reaches production. A Cloudflare API key led to production secrets and a service account with full infrastructure access.
• 18:10. An internal alert fires.
• 20:32. GitBook disables the compromised accounts. That cuts off the attacker and takes the app offline.
• November 3, 11:56. All secrets are rotated. GitBook is back online.

GitBook believes the attack was aimed at one customer. It still treats every customer as exposed, because the attacker could reach stored customer data. The exposed list: API tokens, integration tokens and secrets, session signing secrets, customer content, docs sites behind authenticated access, and the questions visitors asked GitBook Assistant.

The attacker could also act as the GitBook app in the GitHub and GitLab repositories that customers connected. GitBook says it cannot tell if any action was taken there. It found no evidence that customer content was changed. Billing data, passwords and IP addresses were not compromised, the report says.

GitBook says the speed and precision pointed to an attack driven largely by automation and AI.

Why it matters for your business

A docs tool looks low-risk. It is not. It holds a Git connection to your code, API tokens, and the private pages you show only to customers. This is the same lesson as the Notion and Fireworks incident: you carry your vendor's breach.

GitBook rotated what it controls. The remaining work is yours. Do it today:

1. Create new GitBook API tokens. GitBook invalidated the old ones. Update each script and app that used them.
2. Rotate third-party secrets. Each API key you gave GitBook to connect another tool is now suspect.
3. Regenerate the signing key if you use authenticated access with a custom backend. Update the backend too.
4. Re-authenticate the GitBook MCP server if your agents use it.
5. Read the Git history. Check each repository connected through Git Sync for commits you do not know, from November 2 and 3.
6. Search your logs for the three addresses GitBook published: 94.183.188.91, 45.139.84.195 and 198.251.83.217.

Then make the list you did not have last week: each SaaS tool that holds a write token to your code.

Sources: GitBook security incident report, Hackaday.