Heroku Security Notification: Password Reset, May 4, 2022

[huan]

On April 13, 2022, Salesforce Security was notified by GitHub that a subset of Heroku’s GitHub private repositories, including some source code, was downloaded by a threat actor on April 9, 2022. Based on Salesforce’s initial investigation, it appears that unauthorized access to Heroku's GitHub account was the result of a compromised OAuth token.

See:

• https://status.heroku.com/incidents/2413
• https://blog.heroku.com/we-heard-your-feedback