GitBook Data Breach Investigation

GitBook’s November 3 security notice says an attacker obtained unauthorized access to some infrastructure credentials at approximately 7:00 p.m. CET on November 2, 2026 (18:00 UTC). The company describes a targeted attack involving AI agents. It says it detected the activity immediately and temporarily took its app and authenticated documentation sites offline while securing its infrastructure.

GitBook says it blocked the attacker, closed the vulnerabilities, replaced infrastructure credentials and secrets, and invalidated customer API tokens. Its November 3 update, published at 16:21 CET, reports that the app, API, and published documentation are available again, with some services potentially still degraded. Its status page continues to describe monitoring. These are the company’s updates as reviewed on November 3, not a guarantee of current availability or an individual account’s security.

The notice does not provide an affected-person count or identify which customers’ information was accessed. GitBook says a fuller post-incident report will follow. The confirmed intrusion does not establish that every GitBook user or documentation visitor was affected.

We would like to hear from users, subscribers, developers, documentation visitors, and authorized representatives of organizations with related concerns, particularly those who:

• Received a GitBook security notice or a notice from an organization using GitBook.
• Had API tokens, integrations, or Git Sync connections associated with GitBook at the time of the incident.
• Submitted sensitive or identifying information in questions to GitBook Assistant, even without having a GitBook account.
• Observed unfamiliar account or repository activity and have information suggesting a connection to this incident.
• Spent time or money reviewing access, replacing credentials, reconnecting integrations, obtaining security assistance, or responding to disruption.

Simply reading a GitBook documentation page does not establish exposure. Suspicious activity alone does not establish a connection to this incident. You may request a review while the facts are still being investigated.

Keep incident notices, follow-up messages, support tickets, relevant dates and time zones, the names of affected integrations, and records of response costs or losses. Preserve existing audit or access logs when safe, including records that could distinguish normal activity from unauthorized access. For Assistant concerns, note the documentation site and approximate date and describe the type of information submitted without repeating confidential content.

Do not delay containment or credential rotation to collect material for a legal inquiry. Do not send passwords, API token values, integration secrets, private SSH keys, environment files, private source code, confidential Assistant questions, or raw logs containing secrets in an initial email or website submission. You do not need to connect an account or provide remote computer access to request a review.