Incident Title: Unauthorized Access to Internal Admin Panel
Date of Incident: March 2, 2025
Report Completed On: March 5, 2025
Reported By: Tomás De Angelis - Head of Product
Severity Level: Medium
Status: Resolved
On March 2, 2025, Horizon identified unauthorized access to an internal admin panel through an unprotected staging environment. The issue was detected through anomaly alerts triggered by unexpected API calls from an unrecognized IP address. Immediate containment steps were taken, and a full root cause analysis was performed. No customer data was compromised.
| Time | Event |
|---|---|
| 12:42 PM | Suspicious traffic detected to internal admin endpoint |
| 12:45 PM | Security team alerted via PagerDuty |
| 1:00 PM | Access confirmed from staging server with exposed credentials |
| 1:15 PM | Admin panel temporarily taken offline |
| 1:45 PM | IAM credentials rotated; staging server disabled |
| 2:30 PM | Logs reviewed to confirm no lateral movement or data exfiltration |
| 3:00 PM | Customer success and legal teams briefed |
| 4:00 PM | Post-incident response initiated |
A hardcoded admin access token was accidentally committed to the staging repository and deployed without token rotation. This token provided elevated access and was not scoped to IP restrictions.