Sumo Logic security incident (November 2023): a compromised credential opened one of its AWS accounts
Sumo Logic runs cloud log management and SIEM, so its customers hand it their logs, API keys and credentials for the systems it collects from. In November 2023 it disclosed that an attacker had used a compromised credential to get into one of its AWS accounts, and asked every customer to rotate their Sumo Logic API keys. This is the record of what Sumo Logic said at each step, what it concluded, and what was reported later.
Short answer
Was Sumo Logic hacked?
Yes, in a limited sense that Sumo Logic itself confirmed: on 7 November 2023 it disclosed that activity discovered on 3 November had used a compromised credential to access one of its AWS accounts. It locked down the exposed infrastructure, rotated potentially exposed credentials, and urged all customers to rotate their Sumo Logic API access keys.
On 20 November 2023 Sumo Logic closed the investigation, saying it had found “no proof of customer data impact” and that third-party forensic experts had verified this. It published indicators of compromise so customers could check their own environments. How the credential was exposed was not in the original notice; in a July 2024 InformationWeek interview, the company’s security team said a developer had left AWS credentials in cleartext in GitHub. The attacker has not been identified.
Timeline at a glance
3 Nov 2023Sumo Logic discovers a compromised credential was used to access one of its AWS accounts. (Sumo Logic)Confirmed
7 Nov 2023Public notice: customers urged to rotate Sumo Logic API access keys immediately. (Sumo Logic)Confirmed
8–10 Nov 2023Guidance narrowed: API keys stay urgent; collector credentials and passwords dropped from the list. (Sumo Logic)Confirmed
20 Nov 2023Investigation closed: “no proof of customer data impact”, verified by third-party forensics; IOCs published. (Sumo Logic)Confirmed
25 Jul 2024Interview: the AWS credentials had been left in cleartext in GitHub. (InformationWeek)Reported
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Sumo Logic incident timeline, in detail
Confirmed = acknowledged by Sumo Logic, a regulator filing or a court. Reported = credible reporting Sumo Logic has not fully confirmed. Unverified claim = an attacker or leak-site claim.
3 – 20 Nov 2023ConfirmedCloud credential compromise / vendor
Compromised credential used to access a Sumo Logic AWS account
What happened. Sumo Logic said that on 3 November 2023 it discovered activity in which a compromised credential was used to access one of its AWS accounts. It disclosed the incident on 7 November, locked down the exposed infrastructure and rotated every potentially exposed credential for its infrastructure “out of an abundance of caution”, per SecurityWeek and Help Net Security.
Impact. At disclosure Sumo Logic said it had found no impact to its networks or systems and that customer data “has been and remains encrypted”. Customers were told to rotate Sumo Logic API access keys at once and, as precautions, credentials stored in Sumo Logic for third-party data collection and webhook connections, installed-collector credentials and user passwords. Over 8–10 November Sumo Logic narrowed that list, keeping API key rotation as the immediate action. On 20 November it closed the investigation with “no proof of customer data impact”, verified by third-party forensic experts, and published indicators of compromise. Sumo Logic has not published how many credentials were exposed.
Root cause described: AWS credentials left in cleartext in GitHub
What happened. In a July 2024 InformationWeek article, Sumo Logic’s CEO and the chief security officer at the time described the response. InformationWeek reported that “a developer left AWS credentials in cleartext in GitHub, which the threat actor used to gain access to Trufflehog”, a secret-scanning tool. The then-CSO said the company had been “85% there” on moving everyone to IAM roles.
Impact. The CSO held about 50 short calls with customers in the following business days, per InformationWeek. An insider was ruled out; the external actor’s identity “remains a mystery”. This account comes from the company’s executives in a press interview, not from a formal Sumo Logic incident report.
Root cause: Sumo Logic’s November 2023 notices did not say how the credential was compromised; the GitHub cleartext-credential explanation comes from an InformationWeek interview published eight months later.
Scope: Sumo Logic has not said how many credentials were exposed or what the attacker did inside the AWS account beyond what the interview describes.
Customer data: the company’s conclusion is “no proof of customer data impact”, which is a finding of no evidence, checked by a third-party forensic firm. It is not an independent public report.
The pattern across the record
One long-lived key in a code repository
By the company’s later account, the entry point was a static AWS credential committed in cleartext to GitHub, while a move to role-based access was most of the way done. Long-lived cloud keys in code are among the most common ways cloud accounts are opened.
A SIEM holds keys to its customers’ estates
A log platform stores API keys, collector credentials and webhook secrets for the systems it reads from. That is why a vendor-side credential compromise turned into a rotation job for every customer, even with no evidence that customer data was touched.
Not a Salesloft Drift victim
Sumo Logic did not appear in the security-vendor victim lists of the 2025 Salesloft Drift / Salesforce data theft wave that we checked (SecurityWeek, Help Net Security).
What it means for Sumo Logic Sumo Logic customers — and what to do
If you send logs to Sumo Logic, the November 2023 incident is closed, but the lessons apply to any SIEM vendor that holds credentials into your environment.
1.Confirm your API keys were rotated in 2023, and rotate on a schedule
Sumo Logic asked every customer to rotate API access keys. Check that yours were, that the old ones are gone, and that rotation is now routine rather than incident-driven.
List every third-party credential, webhook secret and collector credential held in Sumo Logic. Scope each one to read-only and to the minimum sources it needs.
3.Run the published indicators of compromise
Sumo Logic published IOCs and search guidance on 20 November 2023. If you never ran them against your own cloud logs, do it, and keep the result as evidence.
4.Watch the SIEM’s own access to your cloud
Alert on unusual use of the roles and keys your log vendor uses to collect from AWS or other clouds, from new IPs or for actions outside log collection.
5.Ask your vendor how its own keys are kept out of code
Secret scanning on commits, short-lived role credentials instead of static keys, and how fast they would tell you. Put the answers in your vendor review.
Yes. Sumo Logic disclosed on 7 November 2023 that a compromised credential had been used to access one of its AWS accounts, discovered on 3 November. It closed the investigation on 20 November 2023, saying it found no proof of customer data impact.
Was customer data stolen in the Sumo Logic breach?+
Sumo Logic says no evidence of it was found. Its 20 November 2023 update said the investigation “uncovered no proof of customer data impact”, verified by third-party forensic experts, and that customer data had remained encrypted.
How did attackers get into Sumo Logic?+
Sumo Logic’s notice said a compromised credential was used. In a July 2024 InformationWeek interview, its security team said a developer had left AWS credentials in cleartext in GitHub. The attacker has not been identified.
What did Sumo Logic tell customers to do?+
Rotate their Sumo Logic API access keys immediately. Early guidance also covered third-party and webhook credentials, collector credentials and user passwords; Sumo Logic narrowed that list between 8 and 10 November 2023 and later published indicators of compromise for customers to search.
Was Sumo Logic affected by the Salesloft Drift breach?+
We found no report naming Sumo Logic among the victims of the 2025 Salesloft Drift / Salesforce data theft wave.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Sumo Logic. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →