The JetBrains Cadence Breach: A Wake-Up Call for Software Supply Chain Security

According to The Hacker News, attackers broke into JetBrains' own Cadence cloud service by exploiting a known, unpatched vulnerability in TeamCity. They then extracted AWS credentials and gained access to customer source code and backup data.

This incident is significant because it shows that even companies that make security tools can slip up on patching. If a software vendor like JetBrains leaves a critical hole open, any business using their services can be caught in the blast. The breach also highlights how one exposed credential can cascade into a much larger compromise of cloud infrastructure and customer data.

Why This Incident Exposes Deeper Security Blind Spots

Many organisations assume that a cloud service provider automatically handles all patches. This breach proves that assumption is dangerous. The attackers used a deserialisation vulnerability that had a patch available—but it was never applied to the Cadence server.

Even more concerning is what the attackers accessed: old backups containing credentials and AWS IAM keys. This shows that data sitting in backups can be just as valuable to an attacker as live data. For any business, this is a reminder that security hygiene must extend to every copy of your systems, not just the production environment.

What This Means for Australian SMBs

Australian small and mid-sized businesses often rely on tools like TeamCity, PyCharm, or cloud services to run their development operations. When a vendor's own environment gets compromised, it can leak your sensitive information—source code, login credentials, and cloud keys—into the hands of attackers.

For SMBs with limited IT staff, this can feel like a risk you can't control. However, you can reduce the impact by not trusting any single vendor completely. Treat every third-party service as a potential point of failure, and build your defences accordingly.

What You Can Do Now

  • Immediately patch any TeamCity servers or similar CI/CD tools you manage. Check that all critical updates from your vendors are applied within 48 hours of release.
  • Rotate all credentials and secrets stored in cloud services, especially those tied to AWS, Azure, or Google Cloud. Treat backups that contain credentials as potentially exposed.
  • Enable multi-factor authentication on every account that has access to your code repositories, cloud consoles, and build pipelines.
  • Audit your backup storage—ensure old backups are encrypted and access to them is tightly controlled. Review who can read or copy backup files.
  • Monitor your cloud environment for unusual activity, such as unexpected API calls, new IAM users, or changes to S3 bucket permissions. Set up alerts for these events.

MS&VG helps Australian SMBs strengthen their cybersecurity posture without needing a full in-house team. From vulnerability management to incident response planning, we can guide you through the steps that matter most for your business.