Alleged Żabka leak advertises source code, Jira data, and a reused GitLab token

A data-leak forum listing is advertising an alleged dataset from Polish convenience-store chain Żabka for 5,000 euros, claiming roughly 541,000 Jira issues, about 230,000 IT service-desk tickets, and source code from 89 GitLab repositories. The post names real internal systems, including the chain's point-of-sale platform and SAP environment, and more than 20 outside vendors. A reviewer of the sample archive found the counts internally consistent and noted that a single GitLab access token appears across all 89 repository dumps, pointing to reused credentials rather than a code flaw. Żabka has not confirmed the breach, and the seller's account has no trading history.

Check

Treat the claim as unverified, but use it as a prompt to check whether single tokens or credentials in your own environment grant access across many repositories or systems.

Affected

Żabka and its listed vendors if the data is genuine; the pattern, one reused access token unlocking 89 repositories, is the same stolen-credential route behind many recent source-code and project-tracker thefts.

Fix

Scope access tokens narrowly per repository, rotate and expire them regularly, enforce phishing-resistant MFA on developer accounts, and watch for bulk exports from source and project-tracking systems that signal credential abuse.