Forest Global Training Partners

Cyber Risks · Krebs on Security

Lawmakers Demand Answers as CISA Tries to Contain Data Leak

Summary: A CISA contractor with administrative access to the agency's code development platform created a public GitHub profile called "Private-CISA" containing plaintext credentials to dozens of internal CISA systems, and commit logs showed the contractor disabled GitHub's built-in protection against publishing sensitive credentials in public repos. Sen. Maggie Hassan (D-NH) and Rep. Bennie Thompson (D-MS) sent May 19 letters to acting CISA Director Nick Andersen demanding answers, as CISA said there is "no indication that any sensitive data was compromised" but more than a week after notification by GitGuardian was still invalidating exposed keys, including an RSA private key that TruffleHog creator Dylan Ayrey said granted full access to all CISA-IT repositories until it was invalidated after KrebsOnSecurity's May 20 inquiry.

What's compelling: Ayrey noted that cybercriminal actors monitor GitHub's public commit feed for exposed keys and are often quick to pounce, and the most sensitive secrets appeared in late April 2026 - meaning anyone watching that firehose could have been sitting on access to every repository in the CISA-IT organization, including private repos, CI/CD pipelines, and branch protection settings.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related