Trending Now - CISA Investigates Credential Leak From Contractor's Github Repository

WHO:

Alternet - Guillaume Valadon, a researcher with GitGuardian, stated, "I honestly believed that it was all fake before analyzing the content deeper."

Alternet - Philippe Caturegli, founder of the security consultancy Seralys, commented on the leak, calling it "an embarrassing leak for any company, but it’s even more so in this case because it’s CISA."

Alternet - Guillaume Valadon, a researcher with the security firm GitGuardian, alerted about the sensitive data exposure.

Alternet - Philippe Caturegli, founder of the security consultancy Seralys, commented on the leak.

Alternet - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is involved in the incident.

Alternet - A contractor working for CISA is responsible for the credential leak.

WHAT:

Alternet - The exposed repository was titled "Private-CISA" and contained "administrative passwords to three major cloud servers and login credentials for dozens of internal systems."

Alternet - The contractor's repository was accessible to anyone on GitHub until it was taken offline.

Alternet - The exposed repository contained "a vast number of internal CISA/DHS credentials and files, including cloud keys, tokens, plaintext passwords, logs and other sensitive CISA assets."

Alternet - An expert described the leak as "a textbook example of poor security hygiene."

Alternet - The contractor had regularly committed to the repository since November 2025.

Techmeme - The GitHub repository contained credentials for "several highly privileged [Amazon Web Services] GovCloud accounts and a large number of internal CISA systems."

Alternet - The repository was titled "Private-CISA" and included "cloud keys, tokens, plaintext passwords, logs and other sensitive CISA assets."

Alternet - CISA left sensitive digital passwords exposed on the public internet for months.

Alternet - The exposed files contained administrative passwords to three major cloud servers and login credentials for dozens of internal systems.

Alternet - A security expert described the leak as "the worst leak that I've witnessed in my career."

Techmeme - The GitHub repository that exposed credentials is now offline.

WHERE:

Alternet - The credentials were exposed on a public GitHub repository.

WHEN:

Alternet - The folder containing the exposed passwords was created in November and remained accessible for about six months until it was fixed this month.

WHY:

Alternet - The incident reveals that sensitive credentials should never be stored in unencrypted, plain-text formats, highlighting a violation of fundamental security protocols.

Alternet - The incident reveals systemic vulnerabilities within federal cybersecurity infrastructure, highlighting that sensitive credentials should never be stored in unencrypted, plain-text formats.

Alternet - The incident highlights systemic vulnerabilities within federal cybersecurity infrastructure.

Alternet - CISA is described as chaotic and disorganized, with leadership positions unfilled, and the Trump administration is planning major budget cuts to the agency.

HOW:

Alternet - The contractor used explicit commands to disable GitHub secrets detection features, which contributed to the exposure of sensitive data.

Alternet - The contractor used unsecured methods to transfer files, including explicit commands to disable GitHub secrets detection features.

Alternet - The contractor was suspected of using GitHub to synchronize files between a work laptop and a home computer, regularly committing to the repository since November 2025.

Alternet - The contractor used unsecured methods to transfer files, uploading everything, including passwords written in plain text, to GitHub.

Alternet - Security protocols were violated by storing sensitive credentials in unencrypted, plain-text formats.

(UPDATED May 19, 2026 21:22 UTC)

A significant security breach has occurred involving a repository titled "Private-CISA," which exposed administrative passwords for three major cloud servers and login credentials for numerous internal systems. Guillaume Valadon from GitGuardian expressed disbelief about the authenticity of the leak before conducting a deeper analysis, while Philippe Caturegli from Seralys called it an embarrassing incident, especially given that it involves CISA. The contractor's actions, including disabling GitHub's secrets detection features, have underscored the critical importance of not storing sensitive credentials in unencrypted, plain-text formats.

(UPDATED May 19, 2026 19:34 UTC)

A significant cybersecurity breach has exposed a vast repository containing sensitive internal credentials and files from CISA and DHS, including cloud keys and plaintext passwords. An expert has labeled the leak as "a textbook example of poor security hygiene," emphasizing the systemic vulnerabilities within federal cybersecurity infrastructure. The contractor responsible for the repository had been regularly committing to it since November 2025, using unsecured methods to transfer files, including commands that disabled GitHub's secrets detection features.

(UPDATED May 19, 2026 16:05 UTC)

A significant data breach has been reported involving a GitHub repository titled "Private-CISA," which contained sensitive credentials for several highly privileged Amazon Web Services GovCloud accounts and numerous internal CISA systems. Guillaume Valadon from GitGuardian alerted about the exposure, while Philippe Caturegli of Seralys provided commentary on the leak. It appears the contractor may have been using GitHub to synchronize files between a work laptop and a home computer, regularly committing to the repository since November 2025.

(UPDATED May 19, 2026 04:19 UTC)

The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, is facing a significant incident involving a contractor who left sensitive digital passwords exposed on a public GitHub repository for several months. This leak, described by a security expert as "the worst leak that I've witnessed in my career," included administrative passwords for three major cloud servers and login credentials for numerous internal systems. The incident underscores serious vulnerabilities within federal cybersecurity infrastructure, with CISA being criticized for its chaotic management and unfilled leadership positions, all while facing potential budget cuts from the Trump administration.