Here's the email from CircleCI CEO:

==========================================

We are contacting you to inform you of an ongoing security incident affecting CircleCI customers, as a result of the compromise of our database (http://security.mongohq.com/notice).

We are taking aggressive action to protect your data and systems. At this time, we have suspended all CircleCI account access, and all builds & workers have been suspended. In addition we have revoked all access to Heroku and GitHub OAuth tokens and API keys uploaded to CircleCI.

We do not yet know the scope and impact of the intrusion and are therefore treating this event as if all data has been compromised. While we have no evidence that these credentials have been compromised, we urge you to revoke the following:

SSH keys that were uploaded to CircleCI API tokens added to CircleCI as environment variables secrets stored in GitHub repositories We will be keeping you informed at https://status.circleci.com and will update you at regular intervals as the situation progresses.

We deeply regret that this has happened and are working around the clock to resolve this incident and protect your data and systems.

-- Paul Biggar & Allen Rohner Founders, CircleCI