JetBrains Says Attackers Broke Into Its Cadence Cloud Through an Unpatched TeamCity Server

Key points

• JetBrains disclosed that attackers broke into its Cadence cloud build service last month by exploiting an unpatched critical flaw in TeamCity, its own product.
• The company is telling every Cadence customer to revoke and rotate all credentials and secrets that may have been used inside their build jobs.
• The attackers are unidentified and JetBrains has not named a ransom demand or extortion component to the incident.
• Cadence runs customer software builds in the cloud, so leaked secrets could include cloud keys, signing certificates and deployment tokens.
• Users who ignore the rotation notice risk follow-on intrusions into their own cloud accounts and code repositories.

JetBrains, the Czech-Dutch software maker best known for developer tools like IntelliJ IDEA and the TeamCity build server, has told customers of its Cadence cloud service to treat every secret they ever handed the platform as burned.

The reason: attackers got inside Cadence last month by exploiting a recently disclosed critical vulnerability in TeamCity, the very product JetBrains sells to other companies to automate their software builds. The breach was first reported by The Hacker News.

What is Cadence and why does this matter?

Cadence is JetBrains' hosted build service, meaning customers point it at their source code and it compiles, tests and packages the software for them in the cloud. To do that job, Cadence has to hold sensitive keys belonging to its customers: cloud login tokens, code-signing certificates, deployment passwords.

If attackers rummaged through the environment running those jobs, they may have grabbed any of those secrets. That is why JetBrains is not asking customers to change one password. It is asking them to change all of them.

"Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions," the company said in its notice.

How did the attackers get in?

The attackers exploited an unpatched TeamCity server inside JetBrains' own network. TeamCity is a widely deployed build automation product, and a recently disclosed critical bug in it lets an unauthenticated intruder take control of the server.

JetBrains has not publicly named which specific CVE was abused in its own breach, nor has it named the group responsible. TeamCity flaws have a track record of fast, broad exploitation once details are public, including by state-linked crews and ransomware affiliates hunting for initial access into software supply chains.

The irony is not subtle. A company that ships build software to the world was breached through its own build software, left unpatched on its own infrastructure.

What should customers do right now?

Rotate every credential Cadence ever touched, and do it today. That includes cloud provider keys (AWS, Azure, Google Cloud), container registry logins, package repository tokens, signing keys and any environment variables that held passwords.

After rotating, audit recent activity in the accounts those credentials protected. Look for logins from unfamiliar locations, new users, unexpected API calls, or storage buckets being read at odd hours. If a leaked AWS key was used to spin up servers or exfiltrate data, the evidence sits in cloud audit logs.

Detail	What JetBrains has said
Service affected	Cadence, JetBrains' hosted build service
Entry point	Unpatched TeamCity server in JetBrains' environment
Timing	Intrusion occurred last month
Attackers	Unidentified; no group named
Customer action	Revoke and rotate all credentials and secrets used in Cadence

Does this affect ordinary people?

Not directly, but indirectly it can. If a company you buy software from used Cadence to build its apps, and it fails to rotate its signing keys, a criminal in theory could sign malicious updates that look genuine.

For most readers the practical takeaway is smaller: keep automatic updates on for the apps and operating systems you use, so that if a vendor issues a fix or revokes a compromised certificate, your device picks it up quickly.