{"id":9287,"date":"2026-06-22T07:03:54","date_gmt":"2026-06-22T07:03:54","guid":{"rendered":"https:\/\/gitprotect.io\/blog\/?p=9287"},"modified":"2026-06-22T07:03:58","modified_gmt":"2026-06-22T07:03:58","slug":"the-most-targeted-industries","status":"publish","type":"post","link":"https:\/\/gitprotect.io\/blog\/the-most-targeted-industries\/","title":{"rendered":"The Most Targeted Industries: What DevOps Teams Can Learn from Recent Incidents"},"content":{"rendered":"\n

Which industries are attracting the most attention from cybercriminals today?<\/p>\n\n\n\n

According to the DevOps Threats Unwrapped Report 2026<\/strong><\/a>, Technology and Software<\/strong> organizations remained the most targeted sector. This finding is consistent with our previous research in the 2024 CISO’s Guide to DevOps Threats<\/a>, showing that attackers continue to focus heavily on organizations that build, manage, and distribute software.<\/p>\n\n\n\n

What changed, however, was the composition of the industries that followed close behind.<\/p>\n\n\n\n

Telecommunications and automotive<\/strong> companies experienced a significant rise in attacks, overtaking sectors such as fintech and media compared to previous years. Retail and consumer businesses<\/strong> also remained under sustained pressure as attackers increasingly targeted customer data, source code repositories, cloud infrastructure, and operational systems.<\/p>\n\n\n\n

The common denominator across all these incidents was not simply vulnerable software. It was trust.<\/p>\n\n\n\n

Attackers increasingly abused trusted identities, development platforms, third-party relationships, repositories, and collaboration tools to gain access to sensitive environments.<\/p>\n\n\n\n

Technology and Software is a primary target<\/h2>\n\n\n\n

Organizations operating in the technology and software sector continue to represent attractive targets<\/strong> because they often hold valuable intellectual property, source code, customer data, and privileged access to downstream systems. And several high-profile incidents throughout 2025 illustrate this trend.<\/p>\n\n\n

\n
\"DevOps<\/a><\/figure>\n<\/div>\n\n\n

A back-office application becomes the entry point<\/h3>\n\n\n\n

In February 2025, Orange Group confirmed a data breach affecting a non-critical back-office application. The attacker, linked to the HellCat ransomware group<\/a>, claimed to have maintained access for more than a month before exfiltrating approximately 12K files<\/strong> (totaling ~6.5GB).<\/p>\n\n\n\n

The stolen data reportedly included internal documents, source code, contracts, invoices, customer-related information, and employee email addresses.<\/p>\n\n\n\n

The incident demonstrates a growing trend \u2013 attackers are increasingly targeting secondary systems that organizations often consider low risk<\/strong>.<\/p>\n\n\n\n

Repository access leads to reconnaissance<\/h3>\n\n\n\n

Another example involved Salesloft’s Drift application. Attackers gained access to the company\u2019s GitHub account and spent several months downloading repository content, modifying workflows, and conducting reconnaissance activities<\/strong>.<\/p>\n\n\n\n

Although the intrusion was contained, it highlights how source code repositories remain valuable targets for attackers<\/strong> seeking credentials, infrastructure details, and opportunities for lateral movement.<\/p>\n\n\n\n

Third-party development infrastructure under attack<\/h3>\n\n\n\n

One of the most significant incidents of 2025 involved Red Hat. Attackers gained access to a self-hosted GitLab environment used by the company’s consulting division. According to public reports, the threat actors claimed to have accessed data from approximately 28K repos<\/strong>, including customer engagement reports that potentially contained architecture information, configuration details, and credentials.<\/p>\n\n\n\n

The incident reinforces a key lesson: environments perceived as “non-critical” frequently contain highly sensitive information that can be leveraged in broader attacks<\/strong>.<\/p>\n\n\n\n

What should be the key lesson we learn? These cases reveal a consistent pattern.

Attackers are no longer focusing solely on production systems. They target consulting repositories, development environments, Jira instances, back-office applications, and third-party integrations. Why? As these systems often provide a lower-friction path into an organization’s broader ecosystem.

What should organizations do?

– apply Zero Trust principles across all environments
– segment development and consulting systems from core infrastructure
– enforce MFA and strong identity controls
– rotate shared credentials immediately after third-party incidents
– treat all repositories and collaboration platforms as potential attack surfaces<\/p>\n\n\n\n

The \u201csilver\u201d goes to the Telecommunications and Automotive industries<\/h2>\n\n\n\n

The telecommunications and automotive sectors experienced a sharp increase in attacks throughout 2025. What\u2019s interesting is that many incidents were connected not only to direct attacks but also to breaches occurring within trusted vendors and partners.<\/p>\n\n\n\n

Collateral damage from a third-party breach<\/h3>\n\n\n\n

Following the Red Hat incident, Nissan disclosed that customer information belonging to approximately 21K customers had been exposed<\/strong>. The affected data originated from a Red Hat-managed GitLab environment used to develop a customer management platform.<\/p>\n\n\n\n

Although Nissan found no evidence of misuse, the incident demonstrates how a compromise at one organization can quickly become a supply-chain problem affecting multiple<\/strong> downstream customers.<\/p>\n\n\n\n

Old credentials, new consequences<\/h3>\n\n\n\n

Jaguar Land Rover became another high-profile victim. Attackers reportedly accessed the company’s Atlassian Jira environment using credentials stolen years earlier by infostealer malware. Those credentials remained valid long after the original compromise.<\/p>\n\n\n\n

The attackers eventually exfiltrated approximately 350 GB of data<\/strong>, including internal documents, source code, Jira issues, and employee information.<\/p>\n\n\n\n

Later in the year, JLR suffered another cyber incident that disrupted manufacturing operations, halted production for more than a month, and contributed to financial losses exceeding $890 million<\/strong>.<\/p>\n\n\n\n

Git repositories as high-value targets<\/h3>\n\n\n\n

Europcar also experienced a significant breach after attackers gained access to its GitLab repositories<\/strong> containing mobile application source code and customer information.<\/p>\n\n\n\n

The attackers reportedly obtained Android and iOS source code, SQL backups, environment configuration files, and customer records<\/p>\n\n\n\n

The incident illustrates how repositories frequently contain much more than source code<\/strong>, often exposing credentials, infrastructure configurations, and sensitive business information.<\/p>\n\n\n\n

What should be the key lesson we learn? The automotive and telecommunications sectors highlight the growing importance of supply-chain resilience.

What should organizations do?

– continuously monitor third-party risk
– regularly rotate credentials and tokens
– eliminate long-lived access
– protect development environments with the same rigor as production systems
– prepare recovery plans for vendor-related incidents<\/p>\n\n\n\n

Retail and Consumer Businesses have \u201ca proud\u201d third place<\/h2>\n\n\n\n

The retail sector remains an attractive target because of its large volumes of customer information and highly interconnected systems.<\/p>\n\n\n\n

One token, hundreds of repositories<\/h3>\n\n\n\n

Researchers discovered that a GitHub access token associated with Home Depot remained exposed for more than a year. The token reportedly provided access to hundreds of repositories connected to inventory management, cloud infrastructure, and order fulfillment systems.<\/p>\n\n\n\n

The incident serves as a reminder that exposed credentials continue to represent one of the most common attack vectors in modern DevOps environments<\/strong>.<\/p>\n\n\n\n

The bigger picture<\/h2>\n\n\n\n

The most targeted industries in 2025 were not necessarily the least secure. They were the industries most dependent on software development, cloud infrastructure, automation, and third-party ecosystems.<\/p>\n\n\n\n

Across all sectors, we can see the same pattern:<\/p>\n\n\n\n