Gitbook Breached

75 points by punchmesan 2 hours ago on hackernews | 19 comments

[OP] punchmesan | 2 hours ago

Oof that formatting is rougher than I thought. Will try to clean it up after I'm done reconfiguring gitbook...

: verdverm | an hour ago
new lines between bullets, only italics available, not markdown

This is the public disclosure: https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...

Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above.

petecooper | an hour ago

https://www.gitbook.com/status/security-incident-2026-11-03

philipwhiuk | an hour ago

It's bizarre they have both this and gitbookstatus.com and they contain different info.

: SamyPesse | 46 minutes ago
We summarized more information on this page from recent learnings, than what has been posted as updates on the status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...).

eddythompson80 | 21 minutes ago

Does a security incident page really need to connect to 11 3rd party domains. smh

manytimesaway | an hour ago

FYI, Gitbook was made by the team behing friendco.de, which they killed without any announcement years ago.

: SamyPesse | 56 minutes ago
I’m genuinely sorry the end of friendco.de impacted you. It was 12-13 years ago; the service had little usage at the time, and we probably didn’t handle the end perfectly. I don’t recall exactly, but I can assure you that the team today is more experienced.
: viccis | 55 minutes ago
Not really relevant here.

aliasxneo | an hour ago

"GitBook has been the target of a sophisticated, highly targeted attack using AI agents."

Add it to the list, I guess.

nsoam | an hour ago

Is this what they mean when they talk about accountability laundering?

Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents.

: SamyPesse | 30 minutes ago
This is not what we meant. We will be accountable and will post a complete post-mortem. But it’s important to understand that the attack was a lot more developed than what we’ve been used to with humans, especially in terms of pace and adaptability.

SamyPesse | 59 minutes ago

GitBook’s CTO here

We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.

Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.

We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.

: gkoberger | 57 minutes ago
Good luck... this isn't easy, so best of luck to you and the team.
: latchkey | 54 minutes ago
After turning on 2FA, the page doesn't update to say it is turned on. It still has a configure button. Reloading the page fixes this.

latchkey | 58 minutes ago

One thing that would be appreciated are more details in these sorts of reports.

"the attacker gained unauthorized access to some of our infrastructure credentials"

How? Which infrastructure?

: SamyPesse | 36 minutes ago
We’ll provide details in a long post-mortem. For now, it was important to notify our users as early as possible.

altbdoor | 57 minutes ago

Mentioned this 5h ago, but this post definitely fleshes out more details.

https://news.ycombinator.com/item?id=50351061