Incident Mitigated: Active credential-stuffing attack on cargo service

[yannvr]

Incident Summary

An active credential-stuffing attack was detected on the cargo service: credential-stuffing shape: 40 req/s on one route from a single source.

Actions Taken

As per the active attack runbook, the cargo service was taken offline using take_offline to cut the attack surface.

Verification Evidence

1. Cloud Run Service Configuration (get_service_config):

   • Ingress is now restricted:

   {
     "app": "cargo",
     "ingress": "INGRESS_TRAFFIC_INTERNAL_ONLY",
     "max_instances": 3,
     "url": "https://cargo-obwidwaaya-ew.a.run.app"
   }

2. Public Reachability Probe (get_app_detail):

   • Public endpoint returned HTTP 404, proving it is unreachable:

   {
     "app": "cargo",
     "http": 404,
     "bytes": 272,
     "final_url": "https://cargo-294160018950.europe-west1.run.app"
   }