Incident Post-Mortem: Credential Stuffing Attack on Cargo

[yannvr]

What Happened

An active credential stuffing attack was detected on the cargo service from bridge_red_button with pattern: credential-stuffing shape: 40 req/s on one route from a single source.

Actions Taken

We executed the active attack runbook and took the cargo service offline to mitigate the attack surface.

Verification Evidence

1. Service configuration updated:

{
  "app": "cargo",
  "ingress": "INGRESS_TRAFFIC_INTERNAL_ONLY",
  "max_instances": 3,
  "url": "https://cargo-obwidwaaya-ew.a.run.app"
}

2. Public Reachability:
   The service is now publicly unreachable (returning HTTP 404):

{
  "app": "cargo",
  "http": 404,
  "bytes": 272,
  "body_snippet": "Error: Page not found"
}