> > "On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators..."

> Too vague to be useful. Stolen from whom?

Heroku and Travis CI. That information is literally in the end of the sentence you cut off:

"On April 15, we published a blog detailing an attack campaign utilizing stolen OAuth user tokens issued to two third-party GitHub.com integrators, Heroku and Travis CI."