What happened?
On 24 April 2024, CISA and the FBI published a joint advisory on a compromise of Sisense, the business-intelligence vendor whose embedded-analytics products sit inside thousands of enterprise dashboards — including federal networks via the U.S. Army Corps of Engineers’ use. The short version: attackers breached Sisense’s software-development pipelines, made off with credentials and signing material, and some of those secrets — including AWS keys — surfaced in public circulation, forcing every Sisense customer to treat the vendor’s build systems as part of their own attack surface.
Quick Answer: The Sisense incident was a supply-chain compromise of the vendor’s CI/CD environment disclosed by CISA/FBI on April 24, 2024 — stolen credentials, AWS keys, and code-signing assets circulated publicly, with no backdoored release identified but a mandatory rotate-everything posture for every customer, ahead of an unusual detail: some leaked material remediated by late week.
The advisory was unusually blunt for its length. Agencies instructed federal teams to reset credentials and secrets “that could have been exfiltrated” through their Sisense deployments — an odd phrasing that implied the vendor’s cloud-connected features, telemetry endpoints, and plugin ecosystem as potential siphons. The underscores of the week: cached tokens in BI connectors, long-lived API keys embedded in dashboards, and the Sisense-managed SSO glue that held customers’ identity bridges together.
Day-by-day pressure of a five-day week
The advisory landed on a Wednesday. Customers spent Thursday inventorying every Sisense-touched secret; Friday brought reports that some of the vendor-issued AWS keys were found on public code-hosting and paste sites — escalating the event from “vendor says rotate” to “adversaries have material.” A 29 April follow-up reported that Sisense had by then rotated the exposed assets and hardened affected systems, but the operational damage — thousands of connector secrets rotated under time pressure — was already spent.
| Date | Event |
|---|---|
| ≤2024-04-15 | Sisense detects unusual activity in its development environment; engages Mandiant |
| 2024-04-24 | CISA/FBI AA24-114T advisory; federal agencies ordered to secure Sisense-related credentials “immediately” |
| 2024-04-24→26 | Researchers report Sisense AWS keys circulating on GitHub/code-search channels |
| 2024-04-29 | Sisense states exposure contained; keys rotated; investigation continuing with Mandiant’s help |
| 2024-05 onward | Sector regulators fold “vendor CI/CD compromise” into third-party risk questionnaires |
Why BI tooling became the supply-chain story of the month
Business-intelligence platforms are credential funnels by design: every dashboard is a pile of saved database connections, SaaS API tokens, and cloud-storage keys, refreshed rarely and shared liberally. A compromise upstream of that funnel does not need to backdoor binaries — stealing the vendor’s own credential store yields a master ring of customer-side secrets. Sisense’s embedded-analytics niche amplified this, because its components shipped inside other vendors’ products, meaning some victims did not know they were Sisense customers until the advisory’s product list matched their stack.
- Rotate everything Sisense-adjacent: connector credentials, SSO client secrets, API tokens issued to dashboards, and any AWS keys used in S3/Redshift integrations.
- Treat build artifacts with suspicion: verify signatures and hashes across plugins downloaded during the exposure window; re-issue internal certificates where signing tools were involved.
- Reduce connector blast radius: scoped IAM roles, short-lived tokens, read-only replicas for BI — so the next vendor incident reads less like a master-key event.
- Inventory embedded dependencies: ask vendors which third-party components ship inside their products; maintain that mapping for exactly this kind of week.
FAQ
Was a backdoored Sisense build ever identified?
No — unlike SolarWinds 2020, no trojanized release was confirmed. The material harm was credential and signing-asset theft, not code implantation. That distinction shaped response doctrine: integrity-verify what you ran, rotate what it could touch, and monitor for misuse of what leaked.
Why did CISA and the FBI jointly issue this?
Sisense’s federal footprint — including Army Corps of Engineers deployments — put the incident inside .gov networks, engaging CISA’s protective mission, while evidence handling and attribution interests brought the FBI. The joint signature also signaled the government’s growing willingness to name mid-size commercial vendors during active incidents rather than waiting for polished post-mortems.
What changed for vendor CI/CD security afterward?
The incident landed amid a season of pipeline compromises (Snowflake customer wave weeks later, plus the earlier 3CX-style confusions), and it pushed two practices wider: hardened, ephemeral build infrastructure with no standing secrets, and vendor transparency pages that state — in plain terms — what secrets were exposed, their rotation timestamps, and integrity verification steps for customers. Procurement language began demanding exactly that.
Third-party risk, priced properly
The Sisense week made a tuning-fork argument for re-scoping third-party risk: the question is not only “is the vendor’s product exploitable” but “what does the vendor’s compromise exfiltrate from me.” Mapping that data flow — telemetry, connectors, SSO bridges — turns an abstract questionnaire item into an engineering asset. Organizations that had done the mapping spent April’s week executing runbooks; the rest spent it discovering their own dashboards.
Lessons from the five-day clock
The most practical artifact of the Sisense week was time compression: detection to joint federal advisory took days, not months. That speed is the new normal customers must plan around — a runbook that assumes weeks of vendor opsec silence will fail. Teams that pre-write the “vendor credential-breach” playbook (inventory connectors, rotate in priority order, verify integrity of artifacts) convert a fire-drill into a checklist execution, and post-incident reviews consistently show the difference is preparation, not talent.
A quiet coda
By summer, Sisense’s incident had faded from headlines, but its template stayed: a vendor breach with no malicious code, weaponized purely through stolen credentials, contained in days — yet expensive for every customer downstream. It is worth remembering as the less dramatic sibling of the SolarWinds class, and as proof that in 2024’s threat model, the secrets a vendor holds about you are part of your perimeter, whether or not anyone ships a backdoor.
Detection and response playbook
The Sisense breach was defined by its clock: a CISA advisory within roughly a week of confirmation, driven by exposed credentials found in public code repositories connecting to a cloud environment holding customer data. When your vendor week becomes your customers week, preparation is the only variable you control.
- Assume your CI secrets are already public. The Sisense chain started with credentials committed to repositories — the single most common origin in this entire series. Secret-scanning in pre-commit hooks, repository history audits, and push protection are commodity features now; running them retroactively across your history is an afternoon that prevents an era of exposure.
- Rotate the blast-radius way, not the alphabetical way. When a vendor announces a breach with unclear scope, you cannot wait for their forensics. Pre-rank your integrations by what each vendor credential can reach; on notification day, rotate the top of that list immediately and work down as facts arrive. The pre-ranking is the preparedness — done calmly in advance, it converts a five-day fire drill into a checklist.
- Detect cloud-credential abuse, not just possession. The AWS-key pattern of this breach — valid credentials from an unexpected source — is detectable: alerts on API calls from unfamiliar principals, new regions, or unusual service patterns (S3 enumeration, IAM interrogation). Cloud trail baselines catch this class before the exfiltration matures.
- Manage BI-tool privilege specifically. Analytics platforms hold connections to everything — databases, warehouses, SaaS APIs — making them a credential concentration point second only to CI. Apply the same discipline: least-privilege data connections, rotation of stored credentials, and network restrictions on where the BI platform can reach.
- Write the five-day customer-communication now. Sisense customers learned of risk through a CISA advisory before vendor details arrived. Your version of that scenario — regulator or researcher informs your customers before you finish scoping — deserves a pre-drafted holding statement, a facts-as-known template, and legal review done in peacetime.
Where this sits in the broader pattern
Sisense sat at the intersection of two patterns this series tracks closely: the committed-credential origin (shared with the AnyDesk infostealer path and half the era initial access catalog) and the vendor-becomes-customer-incident cascade (the MOVEit and LastPass mechanics at smaller scale). The CISA involvement added a third dimension: federal urgency when a vendor sits inside government and critical-infrastructure supply chains.
The five-day clock is the modern reality. Disclosure norms, regulatory deadlines, and researcher publication speeds have compressed the gap between first-knowledge and must-communicate to days — while forensic scoping still takes weeks. That asymmetry is the core planning problem of vendor incident response, and it is solved entirely in advance: pre-ranked integrations, pre-rotated-able credentials, and pre-drafted communications. Nothing about the incident itself got faster; only the preparation separates peers.
For the code-repository dimension, the adjacent lesson is the git-credential advisory in this series: developer machines and their credential caches form a seam that connects personal hygiene to enterprise blast radius. Sisense is what that seam looks like when it fails at a vendor instead of in your own estate.
The bottom line. One exposed credential in one public repository became a CISA advisory touching every Sisense customer within days. Scan your history for secrets today, pre-rank your vendor integrations by blast radius, and write the five-day statement in peacetime. When the clock starts, the only thing that finishes in five days is the preparation you already did.
Frequently Asked Questions
.aiopt-faq-block{border:1px solid var(–aio-border,#e2e8f0);border-radius:8px;overflow:hidden}
.aiopt-faq-item{border-bottom:1px solid var(–aio-border,#e2e8f0)}.aiopt-faq-item:last-child{border-bottom:none}
.aiopt-faq-question{width:100%;text-align:left;padding:16px 20px;background:none;border:none;cursor:pointer;display:flex;justify-content:space-between;align-items:center;font-size:16px;font-weight:600;color:#1e293b;gap:12px}
.aiopt-faq-question:hover{background:#f8fafc}
.aiopt-faq-icon{font-size:20px;transition:transform .2s;flex-shrink:0;color:#6366f1}
.aiopt-faq-open .aiopt-faq-icon{transform:rotate(45deg)}
.aiopt-faq-answer{max-height:0;overflow:hidden;transition:max-height .3s ease}
.aiopt-faq-open .aiopt-faq-answer{max-height:1000px}
.aiopt-faq-answer-inner{padding:0 20px 16px;color:#475569;line-height:1.7;font-size:15px}
{
“@context”: “https://schema.org”,
“@type”: “FAQPage”,
“mainEntity”: [
{
“@type”: “Question”,
“name”: “What happened in the Sisense breach of April 2024?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Credentials u2014 reportedly found in publicly accessible code repositories u2014 were used to access Sisense cloud infrastructure holding customer data. CISA issued an urgent advisory within about a week, telling customers to rotate Sisense-related credentials.”
}
},
{
“@type”: “Question”,
“name”: “Why did CISA get involved in the Sisense incident?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Sisense served government agencies and critical-infrastructure customers, so compromise of its platform carried federal supply-chain implications u2014 CISA acted to accelerate customer-side remediation before vendor forensics completed.”
}
},
{
“@type”: “Question”,
“name”: “What is the main lesson of the Sisense breach?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Never commit credentials to repositories, audit historical commits for secrets, pre-rank vendor integrations by blast radius for fast rotation, and prepare regulator-speed communications in advance u2014 vendor incidents become customer incidents on a five-day clock.”
}
}
]
}
Related Reading
- What Studying 33 Historic Cyberattacks Taught Me About Defending Systems Today
- Passwordless in 2026: Why Passkeys Are Finally Killing the Password (and How Attackers Are Adapting)
- 2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
- Authoritative reference: CISA Known Exploited Vulnerabilities
- GoDaddy’s Multi-Year cPanel Breach: 2.5 Years of Dwell
- GoDaddy Breach: One Phished Password, 1.2 Million Sites Exposed
- Codecov Breach: The CI Script That Leaked Build Secrets for Months
