Trigger.dev disclosed that an attacker accessed environment variables for a subset of customers on November 1, 2026. The company blocked the exploit and notified affected account holders the same day. Environment variables store credentials and API keys to connected services, so a single compromise here unlocks access to an organization’s entire dependency chain; affected customers included Cal.com, Emporio Armani, and GovSignals.
Workflow platforms occupy a specific high-value target class: they sit between your code and every external service you depend on. One verified breach exposes credentials to payment processors, analytics, infrastructure, and every integration you’ve wired up. Same-day disclosure looks good until you ask when detection actually occurred. An attacker who copies credentials and logs out looks indistinguishable from an authorized user until the secrets are used elsewhere. The incident doesn’t clarify whether the attacker was blocked on first access or whether extraction and use happened before Trigger.dev detected it.
Sources: Trigger.dev Status Page
Coverage: The Register
Related on this blog: [AUTO] LLMJacking: The Industrialized Theft of AI Keys • [AUTO] Any User Can Become Admin in LiteLLM • [AUTO] MemTensor Worm Exploits GitHub Actions Token Interception