Rapid7 data breach (2021): MDR tooling code and customer alert data exposed through Codecov
Rapid7 sells the InsightIDR SIEM, vulnerability management and a managed detection and response (MDR) service. In 2021 it was one of the companies caught by the Codecov supply-chain compromise, and the exposure touched repositories its MDR team used. This page records what Rapid7 said, with sources.
Short answer
Was Rapid7 hacked?
Yes. On 13 May 2021 Rapid7 said an unauthorised party, using the tampered Codecov Bash Uploader script, accessed “a small subset of our source code repositories for internal tooling for our MDR service”. Those repositories contained some internal credentials and alert-related data for a subset of its MDR customers.
Rapid7 said the credentials had all been rotated, that it contacted the affected customers, and that no other corporate systems or production environments were accessed and no changes were made to the repositories. It said it found no evidence of access to its Insight platform or products, or to customer data stored there.
Timeline at a glance
15 Apr 2021Codecov discloses its Bash Uploader script was modified to steal CI secrets. (The Hacker News)Confirmed
13 May 2021Rapid7 says MDR tooling repositories with internal credentials and some customer alert data were accessed. (SecurityWeek)Confirmed
May 2021Rapid7: credentials rotated, affected MDR customers contacted, Insight platform not accessed. (SiliconANGLE)Confirmed
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Rapid7 incident timeline, in detail
Confirmed = acknowledged by Rapid7, a regulator filing or a court. Reported = credible reporting Rapid7 has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Apr – May 2021ConfirmedSoftware supply chain / CI secret theft
What happened. Attackers modified Codecov’s Bash Uploader script so that it sent environment variables from customers’ continuous-integration systems to an attacker server; Codecov disclosed it on 15 April 2021. Rapid7 said it used the script on a single CI server used to test and build some internal tooling for its MDR service, and that a small subset of source code repositories for that tooling was accessed.
Impact. The repositories held internal credentials and alert-related data for a subset of MDR customers. Rapid7 said it rotated all the credentials, contacted affected customers, and found no access to other corporate systems, production environments, its Insight platform or customer data stored there, and no unauthorised changes to the repositories.
Rapid7 has not published how many MDR customers had alert data in the repositories, or what the alert data contained.
The 2025 Salesloft Drift campaign hit many security vendors; we found no statement from Rapid7 or reputable reporting that Rapid7 was affected, so it is not listed here.
The pattern across the record
CI servers hold the keys
The attack did not need Rapid7’s network; it took whatever secrets sat in environment variables on a build server. MDR tooling repos are attractive because they connect to customer environments.
Managed services widen the blast radius
When a provider watches your alerts, its internal tooling holds your data. Ask what lives in the provider’s repos and pipelines, not just its production platform.
What it means for Rapid7 customers — and what to do
Rapid7 contacted the MDR customers it identified in 2021. For InsightIDR and MDR customers today, the lesson is about the credentials and data a managed provider holds on your behalf.
1.Inventory credentials your MDR provider holds
List every API key, collector token and service account Rapid7 (or any MDR) uses to reach your environment. Give each an owner and a rotation date.
Yes. In May 2021 Rapid7 said the Codecov supply-chain attack let an unauthorised party access a small subset of source code repositories for its MDR internal tooling, which held internal credentials and some customer alert data.
Was Rapid7 customer data exposed?+
Alert-related data for a subset of MDR customers was in the accessed repositories. Rapid7 contacted those customers and said its Insight platform and customer data stored there were not accessed.
What was the Codecov attack?+
Attackers modified Codecov’s Bash Uploader script so it sent secrets from customers’ CI environments to an attacker server. Codecov disclosed it on 15 April 2021.
Was Rapid7 affected by the Salesloft Drift breach?+
We found no statement from Rapid7 or reputable reporting that it was. This page will be updated if that changes.
What should Rapid7 customers do?+
Inventory and rotate the credentials Rapid7 uses to reach your environment, scope its access to your logs, and harden your own CI pipelines against the same kind of attack.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Rapid7. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →