OAKAI FORENSICS • OCTOBER 2026

Case Studies in Catastrophic Secret Leakage: Dissecting Uber, CircleCI, and Toyota

A post-mortem analysis of three landmark security breaches that exposed hundreds of millions of user records, resulting in hundreds of millions in regulatory fines and executive resignations—all originating from simple secret mismanagement.

Case 1: Toyota T-Connect (5 Years on Public GitHub)

296,019 CUSTOMERS EXPOSED

The Vector: In December 2017, a subcontractor development team mistakenly uploaded the source code of Toyota's "T-Connect" telematics service to a public GitHub repository. Hardcoded directly inside the source code was the access key to the central data server holding customer email addresses and management numbers.

The Damage: The repository and plaintext database keys remained public on GitHub for nearly five years (December 2017 to September 2022) before discovery. Over 296,000 customers had their private information exposed.

Key Takeaway: If code contains static access keys, repository visibility changes (e.g. private to public during a fork or subcontractor handover) immediately trigger a catastrophic breach.

Case 2: Uber's AWS Root Credential Leak

57 MILLION USERS & DRIVERS

The Vector: Attackers gained access to a private GitHub repository used by Uber software engineers. Inside the code was a hardcoded Amazon Web Services (AWS) credential with broad access permissions.

The Damage: Using the extracted AWS key, attackers downloaded 16 large archive files from Uber's Amazon S3 datastore containing names, emails, phone numbers, and driver's license numbers of 57 million individuals. Uber ultimately paid $148 million in regulatory settlements and faced criminal obstruction charges.

Key Takeaway: Private repositories are not security boundaries. Any engineer whose laptop or personal GitHub access token is compromised exposes every credential hardcoded in company repositories.

Case 3: CircleCI Third-Party Session Compromise (2023)

SYSTEMIC FLEET RE-ROTATION

The Vector: An engineer's laptop was infected with infostealer malware that bypassed 2FA by exfiltrating an active SSO session cookie. The threat actor used the hijacked session to access production datastores and extract customer environment variables stored inside build pipelines.

The Damage: CircleCI was forced to mandate that its thousands of corporate customers immediately rotate every single AWS key, database password, and API token stored in CI/CD environment variables worldwide.

Key Takeaway: Storing long-lived production secrets inside cloud build environments creates systemic supply chain risks. Secrets should be retrieved JIT (Just-In-Time) by scoped workloads.