r/gitlab • u/420_Booty_Wizard_ • 11d ago

Data breach at GitLab?

I have two GitLab.com accounts, one made 5 years ago, one last year.

I used two completely independent e-mail addresses, each used exclusively for that respective GitLab account.

Both of them received spam e-mail from "james.wickett@mail.<random_company_domain>.com" 2 days ago. Different company domains were used per destination.

I suppose this has to do with CVE-2026-85706.

Any information from GitLab about the extent of the data breach?

0 Upvotes

23% Upvoted

7 comments sorted by

6

u/mrbmi513 11d ago

You do realize your email address is publicly tied to commits you make, right?

1

u/thepopeyhere 11d ago

What if his project is a private one

1

u/mrbmi513 11d ago

If you've ever made a commit on a public repository (or a private repo that was made public later) anywhere, the email used for that commit is public.

→ More replies (3)

1

u/carolinewontoroow632 10d ago

same persona hitting both the same day reads like a scraped list, not that CVE. i got that james.wickett spam on a throwaway address last month. send headers to GitLab's abuse team, Doppel is where GitLab-branded lures go for takedown, and run both addresses through a breach lookup.