- Engineer — Act: If any developer or CI pipeline downloaded the OVHcloud CLI between 12:47–14:21 UTC on October 19, treat that machine as compromised: rotate all secrets stored on disk (API keys, cloud credentials, SSH keys) and audit for any use of those credentials after that window.
- SOC/IR — Act: Hunt across all endpoints for execution of the OVHcloud CLI tool during the 94-minute compromise window; follow up with anomaly detection on credential file access patterns and downstream use of any credentials present on affected machines.
- Leader — Act: If your organization uses OVHcloud, immediately determine whether any engineers or pipelines pulled the CLI tool during the affected window; if exposure is confirmed, treat it as a potential credential-theft incident and invoke your IR process before stolen keys are used.