Docker Hub Container Registry Breach (2019)

Docker Hub is the world's largest public registry for container images, integrated with CI/CD pipelines across virtually every technology company.

25 April 2019. Docker detected unauthorised access to a single Hub database.

26 April 2019. Docker emailed affected users and disclosed publicly.

Impact. ~190,000 accounts affected out of a user base of millions; OAuth tokens revoked.

• Attackers gained brief access to a Hub database.
• Exposed data included usernames, hashed passwords and OAuth tokens for GitHub and Bitbucket.
• Docker revoked tokens and forced password resets for affected accounts.
• Automated builds triggered by revoked tokens broke until users re-linked.

• Registry credentials had CI/CD scope. A Hub compromise reached into source control.
• Token scope was too broad. Many GitHub tokens carried write access.
• Enterprises depended on public infrastructure. Free-tier Hub accounts held production build tokens.
• No standard rotation cadence. Many tokens had existed for years unchecked.

• Emergency token rotation across tens of thousands of CI environments.
• Broken build pipelines for hours or days.
• Industry-wide push for scoped, short-lived registry credentials.

The incident accelerated the shift to OIDC-based short-lived tokens for CI/CD and container registry authentication.

The Docker Hub breach was small in numbers but massive in blast radius because of what those accounts unlocked.

1. Scope registry and CI tokens to minimum required.
2. Prefer short-lived OIDC over static tokens.
3. Inventory CI-linked SaaS accounts.
4. Rotate credentials on a scheduled cadence.
5. Monitor unusual pull and push patterns.
6. Segment production images in private registries.
7. Require vendor breach notification within hours.
8. Report CI/CD supply chain risk to the board.

"A stolen registry token is a stolen build pipeline."