# Security notice: Beware of spear phishing

**URL:** <https://discuss.circleci.com/t/security-notice-beware-of-spear-phishing/54903>\
**Category:** Announcements\
**Tags:** best-practices, security\
**Created:** [October 6, 2026, 12:36am UTC](https://discuss.circleci.com/t/security-notice-beware-of-spear-phishing/54903 "2026-10-06T00:36:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kami](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/kami/32/35940_2.png) [@kami](https://discuss.circleci.com/u/kami)\
**Post date:** [October 6, 2026, 12:36am UTC](https://discuss.circleci.com/t/security-notice-beware-of-spear-phishing/54903/1 "2026-10-06T00:36:29Z")

</div>

Canny, the third-party tool behind our feedback and roadmap board, recently experienced a security incident. **This was a breach at Canny, not of CircleCI’s own systems.** We’re sharing what we know and what we recommend.

**What happened**  
On August 29th, 2026 Canny reported to CircleCI that an unauthorized party accessed one of its internal systems and retrieved API keys and integration credentials. Canny terminated the access on August 28, rotated its keys, and engaged an outside forensics firm. Canny states that passwords are stored hashed and salted, and that 2FA secrets are encrypted. The hashed passwords were within the scope of what was exfiltrated from Canny. In response, Canny reset all Canny passwords.

**What we’ve done**  
CircleCI’s security team opened an incident on August 31 and has:

- Rotated our Canny API and SSO keys and enforced Okta SSO for all Canny access

- Disconnected Canny’s integrations with our other tools while each is verified

- Reviewed audit logs and swept our telemetry for indicators of compromise

**What you should do**

- **Reset your password** if you use [ideas.circleci.com](http://ideas.circleci.com) or [circleci.canny.io](http://circleci.canny.io)

- **Never reuse that password elsewhere.** If you did, change it everywhere.

- **Expect phishing.** Names and emails from vendor breaches are commonly used for targeted messages.

**Protecting yourself from spear phishing**

- Verify unexpected requests through a second channel, not by replying.

- Be wary of urgency, especially around credentials, payments, or “security fixes.”

- Check sender domains and link destinations for look-alikes.

- Use phishing-resistant MFA (passkeys or hardware keys), and never approve a prompt you didn’t initiate.

- Reach CircleCI only through bookmarks or the app, never email links.

- Rotate API tokens if you suspect exposure.

- Report suspicious messages to [security@circleci.com](mailto:security@circleci.com). CircleCI will never ask for your password, tokens, or MFA codes.