Lessons Learned from CISA’s Recent GitHub Leak
Summary: A CISA contractor published dozens of internal CISA credentials, including AWS GovCloud administrative keys and plaintext usernames and passwords for internal systems, in a public GitHub repository called "Private CISA" holding 844 MB of data that stayed public for almost six months before KrebsOnSecurity notified the agency. CISA took more than 48 hours to invalidate the AWS keys after acknowledging the alert, and GitGuardian researcher Guillaume Valadon said CISA had ignored nine automated alerts about the exposed credentials before that notification.
What's compelling: Nine automated alerts went unanswered and the repository sat public for six months, turning what Valadon calls a one-day incident into a six-month exposure - and CISA's own incident playbook did not cover GitHub or other cloud services when the leak landed.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026