Northwind Freight
A CI token left the building. It came back forty-one seconds later.
A deploy token leaked into a public build log at 02:11. Aegis paged Northwind's on-call at 02:12, with the ASN, the calling identity and the four API calls it had already made.
- Sector
- Logistics
- Estate
- AWS · 1,412 workloads · EKS + Lambda
- Regions
- eu-west-1, eu-central-1
- Plan
- Business
- Customer since
- March 2024
- 41sLeak to pagewas 6h 20m, the median for their previous SIEM
- 4API calls before containmentall read-only, none succeeded on S3
- 71%Fewer pages per weekafter correlation replaced per-rule alerting
- 0Post-incident findingsexternal IR review, May 2024
Our old stack would have found this in the morning batch. The morning would have been too late — the token had read access to every shipment manifest we hold.
Northwind moves 240,000 containers a year and runs the software that tells the port which one to lift first. Their estate is not exotic — eleven AWS accounts, EKS in two regions, a long tail of Lambda — but the blast radius of a single leaked credential is the entire manifest database, and the manifest database is commercially sensitive to about nine competitors.
What happened on the night of 14 March
A contractor’s pipeline printed an environment dump on failure. The dump included a long-lived deploy token. The build log was public for eleven minutes before anyone noticed it, and in minute nine the token was used from an ASN in Bucharest.
Aegis did not detect the leak. Nothing could have — the leak was in a third party’s log
viewer. What Aegis detected was the use: an identity that had, for fourteen months, only
ever authenticated from GitHub’s published IP ranges, suddenly authenticating from a hosting
provider, and immediately calling s3:ListBuckets.
The forty-one seconds
CloudTrail delivered the event at 02:11:19. Aegis normalised it at 02:11:23, correlated it against the identity baseline at 02:11:31, opened situation #4412 at 02:11:44, and PagerDuty acknowledged at 02:12:00. Priya’s phone rang while the fourth API call was still in flight.
The call sequence — sts:GetCallerIdentity, s3:ListBuckets, s3:GetBucketPolicy,
s3:ListObjectsV2 — is a textbook orientation pass. None of it succeeded against the
manifest bucket, because the bucket policy required a VPC endpoint the attacker was not
inside. That was luck, and Northwind will tell you so.
The quieter win
The incident is the story people ask about. The number Priya cares about is the 71% drop in weekly pages. Before Aegis, Northwind ran 1,900 individual detections and every one of them could wake someone. Correlating related signals into a single situation — one page, many pieces of evidence — took a two-person team from thirty-eight pages a week to eleven.
Eleven pages a week is a team that still reads them.