On September 3, 2026, JetBrains completed its investigation into a security incident affecting Cadence, its hosted service for running projects on cloud resources from PyCharm. The exploitation window was identified as August 8 to August 24 on api.cadence.jetbrains.com, after attackers exploited a critical TeamCity flaw. JetBrains took the server offline on August 24.
For development teams, the important issue is not only personal-data exposure. JetBrains says a 2024 Cadence server backup, AWS credentials, and files synchronized from PyCharm projects must be treated as potentially exposed. That turns a cloud-service incident into a secrets, repository, and deployment-chain problem.
What JetBrains confirmed
Cadence is an optional JetBrains service integrated with PyCharm. According to the official update, unauthorized actors exploited CVE-2026-63077 on a vulnerable TeamCity environment and then accessed data associated with Cadence. JetBrains invalidated the tokens used by the PyCharm plugin and directly contacted the affected user group.
Confirmed personal data includes usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses. JetBrains also says access to storage containing current-user data could have included source code and credentials. This describes potential exposure; it does not prove that every project or secret was extracted.
Why an old backup still matters
The full Cadence server backup from 2024 is central to the incident. JetBrains says it could contain credentials, configuration, artifacts, and logs, and that multiple AWS IAM users and related secrets were compromised in that backup.
A backup is therefore not just an archive. It can preserve access that was forgotten, rarely used, or never replaced after a migration. If an old secret is still accepted by a repository, bucket, or registry, its age does not automatically make it safe.
The possible project and integration scope
Users who synchronized PyCharm files to Cadence should treat their code, configuration files, and secrets available to executions as potentially compromised. This does not mean every PyCharm project was affected, but it does require teams to look for secrets that may have existed in environment variables, configuration files, scripts, or execution outputs.
The scope goes beyond Git. JetBrains lists AWS accounts, S3 buckets, deployment environments, package and container registries, Slack tokens, webhooks, SSH keys, certificates, and service accounts. A useful review follows each secret to every service it could reach.
What Cadence users should do now
Start by revoking and rotating every secret used by Cadence executions, without waiting for suspicious activity. Include cloud access, GitHub or GitLab tokens, deployment keys, registry credentials, and secrets passed to scripts.
Then review repositories and connected services for the August 8–24 period: unexpected clones or downloads, unknown commits, collaborator changes, webhooks, permissions, personal access tokens, and IAM roles. Treat executions, inputs, and outputs as untrusted until this review is complete.
What small businesses can learn
A team does not need to use Cadence to face the same pattern. Any cloud tool that runs code, synchronizes a repository, or receives environment variables can become a concentration point for secrets. Controls should focus on the access actually passed to the tool, how long it lasts, and how quickly it can be revoked.
For a small team, three measures are immediately useful: assign a unique secret to each service, limit permissions to the required action, and maintain an inventory of dependencies that consume those secrets. Shared accounts or configuration files copied across tools make rotation slower and the blast radius less certain.
The Soclyde connection
Soclyde does not protect JetBrains Cadence and cannot determine which secrets were viewed in this incident. Its role is in the follow-up: generate a different value for each service, keep secrets in a local-first encrypted vault, and quickly find the access that needs rotation.
This does not replace cloud logging or repository review. It does reduce reuse and scattered copies that make response harder when a development tool or supplier is compromised. Read our guide to creating strong, unique passwords or contact Soclyde.
Takeaway
The Cadence incident shows how an infrastructure flaw can reach far beyond an application account: backups, synchronized code, AWS access, and execution secrets can widen the scope. JetBrains’ public statements do not prove that all of these elements were extracted, but they justify preventive rotation and a targeted review.
For a small business, the priority is straightforward: inventory the secrets each tool can access, remove unnecessary copies, rotate access after an incident, and check the traces left in repositories, clouds, and registries.
