All case studies

Where keeping it cost them

Tesla

Left a Kubernetes dashboard open with an over-privileged account

An administrative console was reachable without authentication, and the service account credentials behind it could do more than the workload needed.

Removed: nothing. The dashboard stayed exposed without authentication, and the service account credentials it exposed kept permissions beyond what the workload needed.

Outcome: attackers ran cryptocurrency-mining malware inside Tesla’s cloud account.

The 2018 Tesla Kubernetes cryptojacking incident occurred because a Kubernetes dashboard was exposed without authentication, allowing access to service account credentials with excessive permissions.

Source: Ars Technica, Tesla cloud resources are hacked to run cryptocurrency-mining malware (20 February 2018)