Slack Security Incidents and Data Breaches: A Timeline from 2015 to 2026

Slack has disclosed two breaches of its own systems: its user database in 2015 and some of its private code repositories in 2022. Neither, by Slack's account, exposed customers' messages. The biggest leaks of actual Slack conversations came through customers' own accounts, led by the 2024 Disney leak of about 1.1 TB from thousands of internal channels. Because Slack is not end-to-end encrypted, anyone holding a working login or token can read everything that account can see.

Below are twelve notable incidents, from breaches to bugs that were fixed before anyone is known to have used them. The timeline is current as of 7 November 2026. We found no Slack security incident disclosed in 2026 up to that date.

Slack Security Incident Timeline

Sources: Slack's own security notices, the US Department of Justice, Uber, Nikkei, Google Threat Intelligence and the security researchers' write-ups. Full list in Sources & References.

Breaches of Slack's Own Systems

2015: the user database breach

In March 2015 Slack disclosed that attackers had accessed the database that stored user profile information over about four days in February. According to Slack's notice, as reported at the time, the database held usernames, email addresses and one-way hashed passwords, along with optional details users had added, such as phone numbers and Skype IDs. Slack said it had no indication that the attackers decrypted passwords and that no financial information was taken.

Slack responded by releasing two-factor authentication to all users, earlier than planned, and pointing team owners to a "password kill switch" that resets every password and signs out every session at once.

2019: the password reset tied to 2015

On 18 July 2019 Slack published new information about the 2015 incident. It said it had been contacted through its bug bounty program "with information about potentially compromised Slack credentials," and that in 2015 the attackers "also inserted code that allowed them to capture plaintext passwords as they were entered by users at the time." Slack found that most of the compromised credentials belonged to accounts that logged in during the 2015 incident.

It reset passwords for about 1% of accounts: those created before March 2015 that had not changed their password since and did not use single sign-on. Slack said, "We have no reason to believe that any of these accounts were compromised."

December 2022: private GitHub repositories

On 31 December 2022 Slack said that "a limited number of Slack employee tokens were stolen and misused" to access its externally hosted GitHub repository, and that private code repositories were downloaded on 27 December. Slack was notified of suspicious activity on its GitHub account on 29 December. In a later update it said its investigation showed "a third-party vendor was compromised," without naming the vendor.

Slack said none of the downloaded repositories contained customer data, means to access customer data, or its primary codebase, and that there was no sign of access to its production environment. It invalidated the stolen tokens, rotated relevant credentials and added alerting on the GitHub account. Customers were told no action was needed.

Bugs and Vulnerabilities

These were flaws in Slack's software. Apart from the 2022 invite link bug, which sent password hashes to other users, there is no public evidence that any of them was used against customers.

2017: session token theft through postMessage

Detectify researcher Frans Rosén found that Slack's web app did not check where incoming postMessage events came from. A malicious website could use that to redirect a logged-in user's connection and capture their Slack token, which gives full access to the account. He reported it through HackerOne on 17 February 2017; Slack replied within 33 minutes, fixed it in about five hours and paid a $3,000 bounty. Slack said its investigation found the flaw had not been abused.

2020: one-click code execution in the desktop app

Security engineer Oskars Vegeris reported in January 2020 that a crafted Slack message could chain HTML injection with a bypass of the desktop app's protections to run code on a victim's computer after a single click. According to his report, it could expose private conversations, files, passwords and keys, and could be made to spread by re-posting itself. Slack fixed it by sandboxing the app; the report was made public on HackerOne at the end of August 2020, with a $1,750 bounty.

2022: hashed passwords in invite link events

On 4 August 2022 Slack said a bug had affected users who created or revoked a shared invite link between 17 April 2017 and 17 July 2022. When they did, Slack sent a hashed version of their password to other members of the workspace. The hash was not shown in any Slack client and could only be seen by monitoring encrypted network traffic from Slack's servers. An independent researcher reported it on 17 July 2022 and Slack fixed it.

Slack reset passwords for about 0.5% of its users and said, "We have no reason to believe that anyone was able to obtain plaintext passwords because of this issue." It acknowledged that hashed passwords can still be cracked by brute force, which is why it reset them.

2024: Slack AI prompt injection

In August 2024 the security firm PromptArmor showed that an attacker could post instructions in a public channel, even one only they had joined, and that Slack AI would later follow them when another user asked a question. In their demonstration, Slack AI placed an API key from the victim's private channel inside a "click here to reauthenticate" link pointing to the attacker's server. PromptArmor warned that Slack AI's newly added ability to read files could widen the attack.

Slack first told the researchers that public channel messages being searchable by all members was "intended behavior." A Salesforce spokesperson later told The Register that "a malicious actor with an existing account in the same Slack workspace could phish users for sensitive data," and said, "We've deployed a patch to address the issue and have no evidence at this time of unauthorized access to customer data."

Customer Workspaces Exposed Through Stolen Logins

None of these were breaches of Slack's infrastructure. In each one, an attacker got hold of a real employee's login or session, and Slack then gave them exactly what that employee could see.

2021: Electronic Arts

In June 2021 the attackers behind the EA source code theft told Motherboard they bought a stolen Slack session cookie for $10, used it to enter an EA Slack channel, and then messaged IT support claiming to have lost a phone to get a multi-factor token. EA confirmed the outline of that account to Motherboard. The details come mainly from the attackers.

2022: Uber

Uber said in September 2022 that an attacker, who had likely bought a contractor's password, repeatedly sent two-factor login prompts until the contractor approved one. The attacker gained elevated permissions to tools including Slack, "downloaded some internal Slack messages" and posted a message to a company-wide channel.

2024: Disney and NullBulge

In July 2024 a group calling itself NullBulge published more than a terabyte of data from thousands of Disney Slack channels, the Wall Street Journal reported. Disney said it was investigating. In September 2024 Reuters, citing a report in the Status newsletter, said Disney planned to stop using Slack as its companywide collaboration tool.

In May 2025 the US Attorney's Office in Los Angeles announced that Ryan Mitchell Kramer, 25, of Santa Clarita, had agreed to plead guilty to two federal felonies. Prosecutors said he posted a program online in early 2024 that claimed to create AI-generated art but gave him access to the computers of people who ran it. A Disney employee downloaded it, and Kramer used access obtained from that employee's computer to download about 1.1 TB of confidential data from thousands of non-public Disney Slack channels in May 2024. Posing as NullBulge, he threatened the employee and, when they did not reply, published the Slack files on 12 July 2024 along with the employee's bank, medical and personal information. In May 2026 he was sentenced to 15 months in federal prison.

2025: Nikkei

On 4 November 2025 the Japanese media group Nikkei disclosed that malware on an employee's personal computer had stolen Slack login credentials, which were then used to get into its Slack workspace. Nikkei detected the activity in September. It said the names, email addresses and chat histories of 17,368 people, including employees and business partners, may have been exposed, and that no leak of information related to journalistic sources or reporting had been confirmed. It reset passwords and voluntarily reported the incident to Japan's Personal Information Protection Commission.

Third-Party Integrations: Salesloft Drift (2025)

Between 8 and 18 August 2025 a threat actor Google tracks as UNC6395 used stolen OAuth tokens from Salesloft's Drift chatbot to pull data out of many companies' Salesforce instances. Salesloft said Salesforce temporarily disabled the Drift integration between Salesforce, Slack and Pardot. On 28 August, Google Threat Intelligence said the compromise was not limited to Salesforce and advised all Drift customers to "treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised."

We found no public confirmation that Slack workspace content was taken through Drift. The episode still matters for Slack admins: every installed app holds a token, and a breach at the app's vendor can put that token in an attacker's hands without anyone touching Slack itself.

What the Incidents Have in Common

• Stolen logins and tokens. Slack's 2022 code theft, EA, Uber, Disney and Nikkei all started with a password, session cookie or access token in the wrong hands. Malware on an employee's personal computer was behind both Disney and Nikkei.
• Third parties. A compromised vendor led to the 2022 GitHub theft, and Drift showed how integration tokens extend a workspace's attack surface.
• People as the last control. Uber's contractor approved a push prompt; EA's IT support issued a token to a stranger.
• Server-side readability. Slack decrypts content on its servers to provide search, previews, integrations and AI. That is why one stolen account can export years of history, and why Slack AI could be prompted to read across channels.

What end-to-end encryption would and would not change:

• It would not have stopped an attacker who controls the victim's own device, as in the Disney case. Anything shown on that screen can be copied.
• It would not stop phishing, a user approving a fake login prompt, or an insider sharing what they can already read.
• It would limit what a stolen password, cookie or server-side token unlocks on its own. In an end-to-end encrypted app the keys live on users' devices, so a provider breach, a leaked API token or a compromised vendor yields ciphertext rather than readable conversations.
• It would remove the server-side AI pattern, because the provider cannot read messages to summarise them. That is a real feature trade-off.
• It would not hide metadata such as who is in which channel and when they were active.

For the details of Slack's encryption, including Enterprise Key Management, see Is Slack end-to-end encrypted?

How to Reduce Your Risk on Slack

1. Require two-factor authentication or SSO for everyone, including guests and contractors. Slack recommended two-factor authentication after its 2015 and 2022 password incidents. Prefer phishing-resistant methods over push approvals; see our two-factor authentication guide.
2. Check access logs. Slack points users to their access logs at my.slack.com/account/logs, and owners can review sign-ins across the workspace. Investigate unfamiliar locations and devices.
3. Know where the kill switch is. Workspace owners can reset passwords and sign out all sessions. If you suspect a stolen login, also sign the account out everywhere and revoke its tokens.
4. Audit installed apps and integrations. Remove unused apps, restrict who can install new ones, and rotate tokens when a vendor reports a breach, as Google advised after Drift.
5. Limit what lives in Slack. Set retention policies so a single compromised account cannot export years of history, and keep passwords, API keys and client documents out of channels.
6. Review Slack AI's reach. PromptArmor advised admins to restrict Slack AI's access to documents until the prompt injection issue was resolved; check what your AI features can read today.
7. Protect the devices. Disney and Nikkei both started with malware on a computer used for Slack. Keep personal devices off the workspace where you can, and keep endpoint protection current.
8. Offboard promptly. Deactivate accounts and revoke tokens the day people leave; see offboarding employees without leaking client data. If a breach does happen, our first 24 hours checklist covers the immediate steps.

Frequently Asked Questions

Final Takeaway

Slack's own breaches have been rare and, by its account, did not reach customer messages. The real exposure comes from its design: conversations are readable on the server, so a stolen password, session cookie or token opens a workspace's entire history to whoever holds it. Harden logins, devices and integrations, and keep the most sensitive conversations somewhere that a stolen token cannot read.

If you want team chat where that holds, Lupyd end-to-end encrypts direct messages with the Signal Protocol and group channels with MLS, and encrypts files and backups on the device. Its server still sees group membership, roles and group names, group calls are not yet end-to-end encrypted, and as a young product it has not had an external security audit. Compare the two in Lupyd vs Slack, or Try Lupyd.

Sources & References

• Slack reveals security breach and institutes two-factor authentication, The Next Web, 27 March 2015
• New information about Slack's 2015 security incident, Slack, 18 July 2019
• Slack quick to whack account hijack crack, The Register, 3 March 2017
• Slack pays bounty for critical vulnerability in desktop app, SecurityWeek, 31 August 2020
• How hackers used Slack to break into EA Games, Motherboard (Vice), June 2021
• Notice about Slack password resets, Slack, 4 August 2022
• Security update, Uber Newsroom, September 2022
• Slack security update, Slack, 31 December 2022, updated 9 January 2023
• Slack's private GitHub code repositories stolen over holidays, BleepingComputer, 5 January 2023
• Disney's internal communications leaked online after hack, WSJ reports, Reuters via The Star, 16 July 2024
• Disney to stop using Salesforce-owned Slack after hack exposed company data, Reuters via The Star, 20 September 2024
• Santa Clarita man agrees to plead guilty to hacking Disney employee's computer, downloading confidential data from company, US Attorney's Office, Central District of California, May 2025
• Man who hacked Disney with malicious AI tool pleads guilty, 404 Media, 5 May 2025
• Man who hacked Disney employee's computer sentenced to prison, Patch, 15 May 2026
• Data exfiltration from Slack AI via indirect prompt injection, PromptArmor, August 2024
• Slack AI can be tricked into leaking data from private channels via prompt injection, The Register, 21 August 2024
• Widespread data theft targets Salesforce instances via Salesloft Drift, Google Threat Intelligence Group, August 2025, updated 28 August 2025
• Google warns Salesloft breach impacted some Workspace accounts, The Hacker News, 29 August 2025
• Japanese media giant Nikkei reports Slack breach exposing employee and partner records, The Record, 5 November 2025
• Malware-pwned laptop gifts cybercriminals Nikkei's Slack, The Register, 6 November 2025

Last updated: 7 November 2026.