Grafana Labs suffered a secondary breach after its incident response team failed to rotate a GitHub workflow token exposed during the TanStack npm supply chain attack. According to Grafana’s official statement, the unrotated credential gave threat actor TeamPCP continued access to Grafana’s private GitHub repositories, resulting in source code theft and exfiltration of business contact and operational data. While Grafana confirmed no customer production systems were compromised, the incident demonstrates how procedural gaps in incident response execution can extend an organization’s exposure window well beyond the initial attack.