---
id: "CMP-202611-xqu744"
kind: "campaign"
aliases: []
title: "GitBook breached: attackers got into parts of GitBook's infrastructure on 2 Nov; docs sites and editor taken offline, customer data impact unknown"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "GitBook", "fixed": [], "vendor": "GitBook"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T17:18:08+00:00"
updated_at: "2026-11-03T18:57:29+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T17:18:08+00:00"}]
---

# GitBook breached: attackers got into parts of GitBook's infrastructure on 2 Nov; docs sites and editor taken offline, customer data impact unknown

GitBook (hosted documentation platform) says on its status page that on 2 Nov 2026 it detected unauthorized access to parts of its infrastructure, contained it and took services offline. Published docs sites and the editor went down from about 05:16 UTC on 3 Nov; they were mostly back by 12:32 UTC, with some published sites still degraded. GitBook has not yet said whether customer data was affected, and how the attackers got in is unknown. Separately, on the morning of 2 Nov, Trade.xyz reported unauthorized changes to its GitBook-hosted documentation. It restored the docs by 14:15 UTC and told users not to click links in them. Neither company has said the two events are connected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :GitBook affected ? fixed ?

## How to check

Do you publish docs on GitBook (gitbook.io or a custom domain)? Look at the page history and recent changes in your spaces since 1 Nov 2026 for edits nobody on your team made, especially changed or added links, download URLs, install commands or wallet/contract addresses. Review GitBook audit logs for unknown members, API tokens or integrations, and check Git Sync repos for unexpected commits from GitBook. Specific indicators: unknown.

## Fix

Review published GitBook content and roll back any unauthorized edits. Rotate GitBook API tokens and any Git Sync or integration credentials, and remove members or integrations you don't recognize. Watch GitBook's status page and wait for its post-incident report before trusting that your content is clean. If your docs could have been tampered with, warn your users not to follow links or run install commands from them until you've checked.

## Timeline

- 2026-11-03T17:18:08+00:00 analyst

## Documents

- [describes] Gitbook Breached https://news.ycombinator.com/item?id=50354336
- [describes] GitBook status: Downtime affecting published sites and the editor (unauthorized access detected Nov 2) https://isdown.app/status/gitbook/incidents/680445-downtime-affecting-published-sites-and-the-editor
- [describes] Trade.xyz restores GitBook docs, warns users against links https://crypto.news/trade-xyz-gitbook-docs-unauthorized-activity/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_