US Government Issues Urgent Reminder for Sisense Customers to Update Passwords Following Security Breach

U.S. cybersecurity agency CISA is warning Sisense customers to reset their credentials and secrets after the data analytics company reported a security incident. CISA said it urges Sisense customers to “reset credentials and secrets potentially exposed to, or used to access, Sisense services” and to report any suspicious activity involving the use of compromised credentials to the agency. Founded in 2004, Sisense develops business intelligence and data analytics software for big companies, including telcos, airlines and tech giants. Companies like Sisense rely on using credentials, such as passwords and private keys, to access a customer’s various stores of data for analysis. With access to these credentials, an attacker could potentially also access a customer’s data.

The Cybersecurity and Infrastructure Security Agency (CISA) of the United States is advising customers of Sisense, a data analytics company, to take measures to protect their accounts following a security incident.

CISA issued a statement on Thursday in response to the recent attack on Sisense, which offers business intelligence and data analysis services to global companies.

“We urge Sisense customers to reset any access credentials or private keys that may have been exposed or used to access their services,” CISA said.

The exact details of the cyber attack are still unknown.

Sisense, established in 2004, provides software for analyzing and visualizing large amounts of corporate data for major companies, including telecommunication companies, airlines, and tech giants. Their technology allows them to directly access a customer’s existing systems and cloud platforms.

Since using credentials, such as passwords and private keys, is crucial for accessing a customer’s data, a cyber attacker could potentially acquire access to sensitive information.

CISA is actively collaborating with private sector partners to respond to this incident, particularly when it comes to critical infrastructure organizations that may have been affected.

Sisense serves clients such as Air Canada, PagerDuty, Philips Healthcare, Skullcandy, Verizon, and thousands of other companies worldwide.

News of the breach circulated on Wednesday after Sisense’s chief information security officer, Sangram Dash, issued a statement urging customers to “rotate any credentials you use within your Sisense application.”

There was no response from Dash or a company spokesperson to an email sent by TechCrunch.

In January, Israeli media reported that Sisense had reduced its workforce by half since 2022. It is unclear whether these layoffs have influenced the company’s security measures. Sisense has received almost $300 million in funding from investors, including Insight Partners, Bessemer Ventures Partners, and Battery Ventures.

If you have any information regarding the Sisense breach, you may contact this reporter through Signal or WhatsApp at +1 646-755-8849, or via email. You can also use SecureDrop to send files and documents.