Threat watch / Breach
Trigger.dev: attacker obtained customer root API keys
The background jobs platform Trigger.dev detected anomalous activity on November 1 and found that an attacker had obtained root API keys for some customer environments, about 0.66% of its customers. It revoked every exposed key and asked customers to rotate their credentials. It does not disclose the attack vector.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- Trigger.dev
- How it happened
- Not public yet Checked 9 Nov 2026
- What was stolen
- Customer root API keys for some customer environments. With them, the attacker listed runs, deployments and schedules, which returned run IDs, task names, idempotency keys and metadata. Trigger.dev says it found no evidence of access to other customer data, its services, its production databases or customer dashboard accounts.[1] Checked 9 Nov 2026
- Who was impacted
- 0.66% of all Trigger.dev customers, according to the company. Self-hosted users were not affected.[1] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- Infrastructure alerts on anomalous activity reveal the incident. Trigger.dev discloses "unauthorized access to environment variables" for the affected organizations and emails their owners. [1][2]
- Trigger.dev sends another email to affected customers. [1]
- The incident report says all exposed API keys were revoked and law enforcement and outside incident responders were engaged. The company says it cannot comment on the attack vector yet, to protect the investigation. [1]