DevOps platforms report surge in outages & security threats

GitProtect.io's latest mid-year report details a significant rise in outages and service degradations affecting major DevOps platforms in the first half of 2025.

Incident overview

The report, titled The DevOps Threats Unwrapped: Mid-Year Report 2025, examines incidents from January through June 2025 involving platforms such as GitHub, GitLab, Bitbucket, Jira, and Azure DevOps. According to the findings, a total of 330 incidents impacted the availability and performance of these widely used software development tools, causing disruptions for billions of developers and organisations globally.

Azure DevOps was cited for 74 unique incidents during the period. Notably, the most substantial performance degradation occurred in January and lasted 159 hours, severely affecting build and deployment processes for users worldwide. The report details that this outage was one of the longest registered to date. Azure DevOps components were impacted multiple times: Pipelines experienced 31 incidents, Boards and Test Plans each faced 28, Repos underwent 27, Core Services 16, other services 15, and Artifacts 6. The hardest hit region was Europe, which accounted for 34% of the incidents, while India and Australia experienced the least disruption, with only 4% of incidents combined.

GitHub disruptions

GitHub experienced a significant 58% year-over-year rise in reported incidents, increasing from 69 in the first half of 2024 to 109 in the same period this year. Seventeen of these incidents were classified as major and led to more than 100 hours of total disruption. The majority, 72%, were considered minor. The highest number of incidents in a single month occurred in May, though April saw the greatest total downtime, amounting to 330 hours and six minutes.

GitLab and vulnerabilities

GitLab addressed 65 vulnerabilities in the first half of 2025, compared to 70 in the same period last year. The platform experienced 59 separate incidents, resulting in about 1,346 hours of service disruption. These incidents included partial service interruptions, degraded performance, operational issues, full outages, and cases of planned maintenance. Notable among these was a data breach impacting Europcar Mobility Group, during which attackers accessed GitLab repositories and obtained both source code and personal data belonging to approximately 200,000 customers.

Jira downtime and security incidents

Atlassian's Jira products - including Jira, Jira Service Management, Jira Work Management, and Jira Product Discovery - recorded 66 incidents in the first half of 2025, representing a 24% increase compared to the prior year. Altogether, Jira product disruptions added up to more than 2,390 hours, which equates to nearly 100 days of cumulative downtime. Many of these incidents were attributed to a prolonged maintenance window between mid-March and late May, with free-tier users in Singapore and Northern California experiencing outages lasting up to 120 minutes per customer.

The detailed breakdown shows Jira with 52 disruptions, Jira Service Management with 46, Jira Work Management facing 24, and Jira Product Discovery experiencing 11. The report also highlights recent ransomware attacks by the HellCat group, who utilised stolen login credentials to access Jira environments. High-profile organisations affected by these attacks included Telefónica, Orange Group, Jaguar Land Rover, Asseco Poland, HighWire Press, Racami, and LeoVegas Group.

Industry perspective

"We are witnessing a clear upward trend in outages and disruptions across DevOps platforms, but also in the frequency and sophistication of ransomware attacks and source code thefts, demonstrating that traditional perimeter security is no longer sufficient," comments Greg Bak, Head of Product Enablement at GitProtect. "Anticipating failures before they happen, paired with self-healing infrastructure and recovery strategies that go beyond just technology, will redefine how organizations safeguard uptime, data integrity, and business continuity," Bak adds.

According to GitProtect.io, all data included in the report is based on internal analyses, with rounding applied in some cases. The report underscores the increasing challenges facing organisations as they manage mission-critical development operations amid escalating risks posed by outages, cyberattacks, and data breaches.