A group calling itself NullBulge published material on 12 July 2024 that it described as a complete copy of the Slack workspace used by Disney’s development teams — around 1.1 terabytes covering some 10,000 channels, including messages, files, unreleased project material, raw images and code, some login details and links to internal pages. Disney investigated. Reporting later indicated the company moved away from Slack.
A Chat Archive Is An Unmanaged Record System
Nobody designs a Slack workspace as a data store, and every organisation ends up with one. Credentials get pasted into channels, files get dropped in rather than filed, and the retention setting is whatever the default was on the day it was set up.
The result is a searchable archive of everything an engineering organisation said to itself, held to a standard nobody chose. It is rarely in the inventory of systems holding sensitive data, because it is thought of as conversation.
Some Login Details, Buried In The Volume
The credentials mentioned in the claim matter more than the unreleased projects that drew the coverage. Secrets in chat are live until somebody finds and rotates them, and in a 10,000-channel export nobody knows which they are.
Graded medium: the volume, channel count and contents are the group’s own description of material we have not accessed, and Disney has not published a scope of its own.
Compiled from public reporting of the group’s claims and the company’s response, listed below. Volume and contents are the attacker’s account of its own haul. We have not accessed any published material. Corrections: corrections@forensicpost.com.