Grafana Labs, the company behind the widely used open source data visualization platform Grafana, has confirmed that hackers accessed and copied portions of its source code, then attempted to extort the company with threats to publish the material.

The intrusion was traced to the abuse of a stolen authentication token tied to Grafana Labs’ GitLab environment, the system the company uses to manage and develop its code. According to the company, the token did not grant access to customer records, financial information, or production systems, but it did allow the attackers to clone internal repositories.

Grafana Labs said it quickly revoked the compromised token and implemented additional security controls to prevent similar breaches. The company has not disclosed how the token was obtained, but indicated that its investigation is ongoing and that it will release a fuller report once the forensic work is complete.

The attackers allegedly tried to blackmail Grafana Labs, demanding payment in exchange for not releasing the stolen codebase. The company refused, publicly aligning its stance with long-standing guidance from law enforcement agencies, including the FBI, which warn that paying ransoms encourages further attacks and offers no guarantee that stolen data will be destroyed or withheld from publication.

Grafana’s flagship software is open source, and much of its code is already publicly available. That raises questions about what, if any, proprietary components or internal information may have been taken beyond the public repositories. Grafana Labs has not detailed whether private plugins, commercial features, or internal documentation were among the data accessed.

The incident highlights a growing trend in cyber extortion, where attackers increasingly target software development infrastructure and source code rather than only customer databases. Even when no personal data is exposed, theft of code can pose reputational risks, expose security flaws, and give competitors or malicious actors insight into how a platform operates.

By refusing to pay, Grafana Labs is positioning itself as a test case for how open source companies can respond to code-focused extortion attempts. The company maintains that no customer data was compromised and that its services remain safe to use, while it continues to harden its development environment against future attacks.