Codecov attackers breached hundreds of restricted customer networks

Assessment

The figure originates with Reuters, reporting on 19 April 2021 and citing investigators who spoke on condition of anonymity. It was repeated widely from there, and the underlying reporting also describes the attackers using automation to reuse harvested credentials at scale and directing particular effort at other software development tool makers and technology service providers. No named authority has confirmed a count. Codecov has published no figure for downstream network access. CISA's alert of 30 April 2021 does not quantify impact. The FBI's San Francisco field office investigated and, according to the same reporting, notified dozens of likely victims — a number an order of magnitude smaller than "hundreds," and describing notification rather than confirmed intrusion. The reporting is credible and consistent with what victims disclosed voluntarily. It is rated Assessed rather than Verified because its sole basis is unnamed sources, and because a figure repeated across hundreds of articles still rests on the same single unattributed origin.