Datadog data breach (2016): production servers and a customer credentials database
Datadog runs monitoring, log management and a cloud SIEM as a service, so customers hand it API keys and cloud credentials for the systems it watches. In July 2016 an attacker got into a few of its production servers and took the database that held them. This is the record of what Datadog said at the time and later in its SEC filings, plus what has not been a breach since.
Short answer
Was Datadog hacked?
Yes. In July 2016 Datadog detected unauthorised activity on “a handful of production infrastructure servers, including a database that stores user credentials,” its chief security officer Andrew Becherer said at the time. Datadog later confirmed in its SEC filings that an unidentified third party “exfiltrated data” from its infrastructure, including a database of customers’ credentials for its platform and for third-party integrations.
Datadog said passwords were hashed with bcrypt and a unique salt, but it reset all user passwords and told customers to revoke or rotate every credential they had shared with it, such as AWS keys. A customer reported unsuccessful attempts to use AWS credentials shared with Datadog. Datadog said its agents on customer hosts were not affected. No later breach of Datadog has been publicly confirmed; its 20 October 2025 incident was an availability problem tied to AWS us-east-1, not a breach.
Timeline at a glance
8 Jul 2016Datadog detects unauthorised activity on production servers, including a user-credential database. (The Register)Confirmed
11 Jul 2016All passwords reset; customers told to revoke or rotate credentials shared with Datadog. (Threatpost)Confirmed
Feb 202110-K confirms the 2016 attacker exfiltrated data, incl. credentials for third-party integrations. (SEC 10-K)Confirmed
20 Oct 2025Data delays during the AWS us-east-1 outage: an availability incident, not a breach. (Datadog status)Not a breach
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Datadog incident timeline, in detail
Confirmed = acknowledged by Datadog, a regulator filing or a court. Reported = credible reporting Datadog has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Production servers breached and customer credentials database exfiltrated
What happened. On 11 July 2016 Datadog CSO Andrew Becherer said the company had “detected unauthorized activity associated with a handful of production infrastructure servers, including a database that stores user credentials,” in an intrusion reported as happening the previous Friday. He said a user had reported unsuccessful attempts to use AWS credentials shared with Datadog, and that “to err on the side of caution, we are recommending revocation of all credentials shared with Datadog.” Datadog said it had rebuilt the compromised systems. Its Form 10-K for 2020 later described the event as an unidentified third party gaining access to, and exfiltrating data from, infrastructure including a database storing customers’ credentials for its platform and for third-party integrations, some of which included confidential and personal information.
Impact. Datadog said passwords were stored with bcrypt and a unique salt. It forced a reset for all users, including those signing in with Google or SAML, and emailed admins instructions to rotate integration credentials, recommending AWS IAM role delegation instead of shared access keys. Datadog said its agents were not affected because they only send data outbound and never receive code or data from its servers. Datadog did not publish how many customers or credentials were in the database.
Who was affected: Datadog said at the time that only users with a stored password were affected, yet it forced a reset for every user, including Google Auth and SAML users, as a precaution.
Exfiltration: the July 2016 statements described “unauthorized activity”; Datadog’s later 10-K states plainly that data was exfiltrated. The 10-K is the later and fuller account.
Numbers: Datadog never published how many accounts or integration credentials were in the database, and this page quotes none.
The pattern across the record
A monitoring vendor stores your keys
To pull metrics and logs from AWS and other services, Datadog held customers’ access keys. One database became a skeleton key to many customers’ clouds, which is why Datadog told everyone to rotate rather than only to change passwords.
Role delegation beats shared keys
Datadog’s own advice was to move AWS integrations to IAM role delegation, so there is no long-lived customer secret on the vendor’s side to steal. The same applies to any SIEM or observability vendor today.
What it means for Datadog customers — and what to do
The 2016 breach is long closed, but the exposure it showed still applies to every Datadog Cloud SIEM and log management customer: Datadog holds credentials into your environment.
1.Replace stored cloud keys with role delegation
Use AWS IAM role delegation (and the equivalent for Azure and GCP) so Datadog never holds a long-lived access key.
Yes. In July 2016 an attacker accessed a handful of Datadog production servers and exfiltrated data, including a database of customers’ credentials for Datadog and for third-party integrations, per Datadog’s statements and its later 10-K.
What data was taken in the Datadog breach?+
A database storing customers’ Datadog credentials (bcrypt-hashed passwords) and credentials for third-party integrations such as AWS. Datadog’s 10-K says some included confidential and personal information. It did not publish a count.
Has Datadog been breached since 2016?+
No later breach has been publicly confirmed by Datadog. Its 20 October 2025 incident was data delays during the AWS us-east-1 outage, an availability problem rather than a breach.
Were Datadog agents affected?+
Datadog said no: its agents only send data outbound over HTTPS and do not receive code or data from Datadog’s servers, and they do not send local credentials to Datadog.
What should Datadog customers do?+
Use cloud role delegation instead of shared access keys, inventory and rotate Datadog API and application keys, and review Datadog’s audit trail for key and integration changes.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Datadog. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →