What happened?
On 24 April 2024, CISA and the FBI published a joint advisory on a compromise of Sisense, the business-intelligence vendor whose embedded-analytics products sit inside thousands of enterprise dashboards — including federal networks via the U.S. Army Corps of Engineers’ use. The short version: attackers breached Sisense’s software-development pipelines, made off with credentials and signing material, and some of those secrets — including AWS keys — surfaced in public circulation, forcing every Sisense customer to treat the vendor’s build systems as part of their own attack surface.
Quick Answer: The Sisense incident was a supply-chain compromise of the vendor’s CI/CD environment disclosed by CISA/FBI on April 24, 2024 — stolen credentials, AWS keys, and code-signing assets circulated publicly, with no backdoored release identified but a mandatory rotate-everything posture for every customer, ahead of an unusual detail: some leaked material remediated by late week.
The advisory was unusually blunt for its length. Agencies instructed federal teams to reset credentials and secrets “that could have been exfiltrated” through their Sisense deployments — an odd phrasing that implied the vendor’s cloud-connected features, telemetry endpoints, and plugin ecosystem as potential siphons. The underscores of the week: cached tokens in BI connectors, long-lived API keys embedded in dashboards, and the Sisense-managed SSO glue that held customers’ identity bridges together.
Day-by-day pressure of a five-day week
The advisory landed on a Wednesday. Customers spent Thursday inventorying every Sisense-touched secret; Friday brought reports that some of the vendor-issued AWS keys were found on public code-hosting and paste sites — escalating the event from “vendor says rotate” to “adversaries have material.” A 29 April follow-up reported that Sisense had by then rotated the exposed assets and hardened affected systems, but the operational damage — thousands of connector secrets rotated under time pressure — was already spent.
| Date | Event |
|---|---|
| ≤2024-04-15 | Sisense detects unusual activity in its development environment; engages Mandiant |
| 2024-04-24 | CISA/FBI AA24-114T advisory; federal agencies ordered to secure Sisense-related credentials “immediately” |
| 2024-04-24→26 | Researchers report Sisense AWS keys circulating on GitHub/code-search channels |
| 2024-04-29 | Sisense states exposure contained; keys rotated; investigation continuing with Mandiant’s help |
| 2024-05 onward | Sector regulators fold “vendor CI/CD compromise” into third-party risk questionnaires |
Why BI tooling became the supply-chain story of the month
Business-intelligence platforms are credential funnels by design: every dashboard is a pile of saved database connections, SaaS API tokens, and cloud-storage keys, refreshed rarely and shared liberally. A compromise upstream of that funnel does not need to backdoor binaries — stealing the vendor’s own credential store yields a master ring of customer-side secrets. Sisense’s embedded-analytics niche amplified this, because its components shipped inside other vendors’ products, meaning some victims did not know they were Sisense customers until the advisory’s product list matched their stack.
- Rotate everything Sisense-adjacent: connector credentials, SSO client secrets, API tokens issued to dashboards, and any AWS keys used in S3/Redshift integrations.
- Treat build artifacts with suspicion: verify signatures and hashes across plugins downloaded during the exposure window; re-issue internal certificates where signing tools were involved.
- Reduce connector blast radius: scoped IAM roles, short-lived tokens, read-only replicas for BI — so the next vendor incident reads less like a master-key event.
- Inventory embedded dependencies: ask vendors which third-party components ship inside their products; maintain that mapping for exactly this kind of week.
FAQ
Was a backdoored Sisense build ever identified?
No — unlike SolarWinds 2020, no trojanized release was confirmed. The material harm was credential and signing-asset theft, not code implantation. That distinction shaped response doctrine: integrity-verify what you ran, rotate what it could touch, and monitor for misuse of what leaked.
Why did CISA and the FBI jointly issue this?
Sisense’s federal footprint — including Army Corps of Engineers deployments — put the incident inside .gov networks, engaging CISA’s protective mission, while evidence handling and attribution interests brought the FBI. The joint signature also signaled the government’s growing willingness to name mid-size commercial vendors during active incidents rather than waiting for polished post-mortems.
What changed for vendor CI/CD security afterward?
The incident landed amid a season of pipeline compromises (Snowflake customer wave weeks later, plus the earlier 3CX-style confusions), and it pushed two practices wider: hardened, ephemeral build infrastructure with no standing secrets, and vendor transparency pages that state — in plain terms — what secrets were exposed, their rotation timestamps, and integrity verification steps for customers. Procurement language began demanding exactly that.
Third-party risk, priced properly
The Sisense week made a tuning-fork argument for re-scoping third-party risk: the question is not only “is the vendor’s product exploitable” but “what does the vendor’s compromise exfiltrate from me.” Mapping that data flow — telemetry, connectors, SSO bridges — turns an abstract questionnaire item into an engineering asset. Organizations that had done the mapping spent April’s week executing runbooks; the rest spent it discovering their own dashboards.
Lessons from the five-day clock
The most practical artifact of the Sisense week was time compression: detection to joint federal advisory took days, not months. That speed is the new normal customers must plan around — a runbook that assumes weeks of vendor opsec silence will fail. Teams that pre-write the “vendor credential-breach” playbook (inventory connectors, rotate in priority order, verify integrity of artifacts) convert a fire-drill into a checklist execution, and post-incident reviews consistently show the difference is preparation, not talent.
A quiet coda
By summer, Sisense’s incident had faded from headlines, but its template stayed: a vendor breach with no malicious code, weaponized purely through stolen credentials, contained in days — yet expensive for every customer downstream. It is worth remembering as the less dramatic sibling of the SolarWinds class, and as proof that in 2024’s threat model, the secrets a vendor holds about you are part of your perimeter, whether or not anyone ships a backdoor.
