JetBrains confirmed that the Cadence service was breached after attackers exploited the critical vulnerability CVE-2026-63077 in TeamCity, the platform Cadence uses to orchestrate workloads. Through an optional PyCharm plugin, Cadence enables projects to run on cloud computing resources, making the incident relevant not only to service accounts but also to the systems and credentials that users connect to execution environments.
According to the latest update published by JetBrains on August 28, 2026, at 11:50 a.m. Central European Time, api.cadence.jetbrains.com was the affected server. The affected period extends from August 8 to August 24, 2026; the company detected the exploitation on August 23 and then took the server offline on August 24 while continuing its investigation.
What data and systems were compromised?
JetBrains said the attackers were able to access and extract personal data, including usernames, real names, email addresses, the times of users’ last logins, and the IP addresses used for their most recent access. This could increase the risks of targeted phishing, social engineering, and identity impersonation.
The company also confirmed that a complete backup of the Cadence server from 2024 was compromised. According to JetBrains, the backup contains credentials, settings, execution-generated files, and logs or other data, and should therefore be treated as potentially exposed. The breach also affected several AWS IAM users and the credentials and secrets associated with them, including accounts belonging to JetBrains employees who used the service, as well as files stored in S3 buckets within the company’s AWS accounts.
JetBrains is still determining the full scope of the data that was accessed and currently does not know whether the attackers reached customer-owned storage buckets. However, users who configured Cadence to access their own buckets should assume that the credentials used for that connection may have been exposed.
Actions required from Cadence users
- Revoke all credentials and secrets that may have been used to run Cadence operations, then rotate them.
- Review AWS accounts, S3 buckets, deployment environments, package repositories, and container repositories for unusual activity.
- Inspect code repositories for unauthorized clones, downloads, or changes, including modifications to secrets, webhooks, users, and permissions.
- Review project files and code uploaded or synchronized from PyCharm, and rotate any keys, tokens, or sensitive data embedded in them.
- Treat all executions and their inputs and outputs as untrusted until the investigation is complete.
The credentials JetBrains recommends changing include AWS, Azure, and Google Cloud keys; GitHub, GitLab, and Bitbucket tokens; npm, Maven, NuGet, and PyPI credentials; container registry keys; as well as Slack tokens, SSH keys, signing keys, and service accounts.
What does the incident mean in practice?
The risk here is not limited to the leakage of identifying data; a project execution environment may handle cloud secrets, repository keys, and deployment systems. Therefore, the most urgent action is to assume that every secret stored in Cadence or its backup, or accessible to executions, was exposed, even if there are no direct indicators of compromise. JetBrains published IP addresses and indicators of compromise, but warned that they are not comprehensive and that their absence does not prove that an account or system is safe.
JetBrains took the server offline, revoked the access tokens used by the Cadence plugin in PyCharm, and notified the relevant authorities. It also allows users to request a list of the credentials and secrets associated with their use of the service, while warning that this list is not comprehensive. The scope of access to customer data and the final results of the investigation remain open questions that will require monitoring of subsequent updates.