Compromised tokens In the latest development, Heroku's ongoing investigation has revealed that the compromised token for a Heroku machine account enabled attackers to “gain access to a database and exfiltrate the hashed and salted passwords for customers' user accounts”.