From December 2025 through January 2026, a threat group automated the process of generating trial Atlassian Jira Cloud accounts en masse. They then used those accounts to deploy a spam campaign targeting government and corporate entities that use Jira, directing recipients to online casinos and fraudulent investment scheme sites.
By making the spam messages come from real accounts, the attackers leveraged brand name recognition and the ubiquity of Jira notifications to make their messages appear legitimate. This attack exemplifies the way cybercriminals abuse employees’ trust in widely used SaaS collaboration tools to overcome cyber-savvy skepticism.
For broader context, Atlassian is a global software company known best for its tools Jira and Confluence. Jira manages issues, work items, and workflows, while Confluence operates as a collaborative knowledge base or corporate wiki. Tens of thousands of companies rely on these tools, making them a top target for threat actors seeking sensitive customer data. Understanding Atlassian data security best practices sets you up to outsmart even sophisticated attacks like this one.
Atlassian Security Best Practices
Like most prominent SaaS-based project management products, Atlassian uses a shared responsibility model in which some but not all security responsibilities fall on the customer. For example, Jira has built-in security features such as multi-factor authentication and encryption, but organizations themselves are responsible for the security of their data, with responsibilities including:
Endpoint security
Customer data protection
Backup and recovery
You can make sure your cybersecurity program is meeting Atlassian security best practices by addressing login security, appropriately managing accounts, using foundational security controls, deploying updates, conducting security assessments, and establishing backups.
Enforce Login Security Redundancies
Strong authentication reduces the likelihood of unauthorized access. Ensure your Atlassian instances are equipped with login security redundancies like strong password policies, multi-factor authentication, and single sign-on portals. Bot control measures can keep automated scripts out of the login process, and sensible limits around API tokens and third‑party app access are also essential to keeping bad actors out.
Manage Accounts
Administrators should routinely audit activity logs, adjust permissions based on least privilege, and quickly remove inactive users to avoid takeover of abandoned credentials. User training on identity access management also plays a vital role, giving employees a sense of responsibility over the privacy of their Atlassian credentials.
Use Foundational Security Controls
General best practice security controls also apply to SaaS products like Jira and Confluence. Zero trust access controls, IP allowlisting, continuous monitoring, and data security posture management (DSPM) are highly impactful cybersecurity strategies you can use to protect data. For example, a powerful DSPM tool can tell you exactly where your sensitive data lives and pinpoint risky access configurations before they’re exploited.
Deploy Regular Updates
Delaying patching is simply not worth the risk. According to CISA, attackers use 42 percent of known exploited CVEs within the first 24 hours. Threat actors regularly exploit Confluence vulnerabilities on servers that aren't updated, enabling remote code execution and resulting in ransomware attacks. Keeping versions current greatly enhances Confluence security and reduces your exposure risk.
Conduct Security Assessments
Routine security assessments, including offensive security practices such as red‑team exercises and penetration testing, help validate Atlassian instances against threats. It’s common for organizations not to have the resources to conduct such assessments in-house, but you can use automated penetration testing software or offensive security services to discover gaps in security.
Establish Backups
Reliable backups help organizations stay resilient against data loss from both malicious activity and simple human error (which is more common than you may think). Backups also make it vastly easier to restore to a previous configuration state or “undo” bulk changes if necessary.
The Risks of Ignoring Atlassian Security Best Practices
Threats such as XML external entity (XXE) injection, server‑side request forgery (SSRF), cross‑site scripting (XSS), denial‑of‑service attacks, and man‑in‑the‑middle attacks are much more likely to succeed when organizations don't properly secure their Atlassian environments. The exposure of sensitive data such as API keys, login credentials, credit card numbers, contact information, and physical IP addresses can lead to:
Financial losses
Regulatory penalties
Reputational damage
Other Notable Jira and Confluence Incidents
Jira and Confluence are indispensable to organizations processing large amounts of data, but that means they’re also indispensable to cybercriminals and can cause major business disruptions if unavailable.
Accidental Server Outage
In 2022, a faulty maintenance script accidentally deleted data across hundreds of Jira and Confluence cloud instances, causing an outage lasting two weeks. The company shared the cause in a post-incident review: Engineers executed a script intended to remove legacy data as part of scheduled maintenance, but the script exceeded its intended scope and deleted substantially more data than planned.
Crypto Mining Vulnerability
Threat actors took advantage of a now‑fixed critical vulnerability (CVE‑2023‑22527) in Confluence, installing cryptocurrency‑mining tools on exposed systems. The flaw allowed remote code execution on outdated Confluence versions and was patched by Atlassian in January 2024.
Template Injection Vulnerability
How Fortra Strengthens Jira and Confluence Security
Fortra DSPM discovers, classifies, and protects your data wherever it lives — including SaaS solutions like Jira and Confluence. Fortra DSPM delivers:
Improved visibility across data ecosystems: It maps where sensitive data resides across on‑prem systems, cloud platforms, and SaaS apps, giving organizations clear insight into data movement and usage.
Risk‑based prioritization: It prioritizes data by sensitivity, exposure, and business impact, helping teams focus protection efforts. This ensures the most critical data is protected first.
Proactive risk mitigation: Continuous posture assessments identify misconfigurations, shadow data, and excessive access in environments including Jira and Confluence, empowering organizations to resolve issues before they become breaches.
Reduced time and cost of incident response: Streamlined workflows and integrations accelerate investigation and remediation of data risks, lowering operational burden and costs.
