Article
Most targeted EU sectors in 2025: the ENISA ranking
ENISA's Threat Landscape 2026 ranks public administration as the most targeted EU sector in 2025, at 31.8% of recorded events. Business services (8.5%), transport…
Read more
Significant cyber incident
CISA contractor GitHub credential exposure
In May 2026 CISA learned that internal AWS GovCloud keys and other internal material had been posted in a public GitHub repository owned by one of its contractors.
In short
In May 2026 CISA learned that internal AWS GovCloud keys and other internal material had been posted in a public GitHub repository owned by one of its contractors. A security researcher found it by scanning public code. The contractor had copied CISA build and deployment code to a personal account, including admin and build credentials. CISA says the credentials were not used outside its own environments and no customer or mission data was exposed.
What happened
On Friday 15 May 2026, CISA began an internal incident response after an investigative reporter asked about internal CISA AWS GovCloud keys and other information in a public repository. The reporter had received the information from a security researcher whose company continuously scans public code repositories.
The repository was not part of CISA’s official GitHub. It was a personal repository owned by a contractor, who had uploaded copies of a CISA build and deployment repository, including Infrastructure as Code and build code, and had copied admin and build credentials into it.
CISA took the repository offline, kept a copy, reset credentials and later rotated all credentials in every environment where the individual was an administrator. It published its own account on 9 July 2026.
Timeline
-
Before 15 May 2026
A contractor uploads a copy of a CISA build and deployment repository, with admin and build credentials, to a public personal GitHub repository (CISA does not give the date).
-
Before 15 May 2026
The researcher tries several routes to report it, including emailing the contractor and CISA's vulnerability disclosure platform, then involves a reporter (CISA does not give dates).
-
Friday 15 May 2026
An investigative reporter asks CISA about AWS GovCloud keys in a public repository. CISA starts internal incident response.
-
Friday 15 May 2026
The public repository is taken offline and a copy is saved. The development environment is taken offline and credentials are reset. The contractor's access is revoked.
-
After 15 May 2026
CISA analyses the repository copy, telemetry and logs. It finds the credentials were not used outside its environments.
-
After 15 May 2026
CISA rotates all credentials in environments where the individual was an administrator, tunes repository allow and deny lists and limits uploads to public repositories.
-
After 15 May 2026
The development environment is brought back online.
-
19 May 2026
House Homeland Security Democrats post a page about a demand from Representatives Thompson and Ramirez for a briefing.
-
9 July 2026
CISA publishes "Lessons from CISA's Cyber Incident".
How the attack worked
The exposure
According to CISA, a contractor copied a CISA build and deployment repository to a personal GitHub account to create cloud infrastructure autonomously. The copy held CISA’s Infrastructure as Code and build code. The contractor also copied admin and build credentials into the public repository.
How it was found
A security researcher whose company continuously scans public code repositories found the material and passed it to an investigative reporter, who asked CISA about it. CISA says the researcher first tried other routes, including emailing the contractor and using CISA’s vulnerability disclosure platform.
Why it was possible
CISA says its users could upload to public repositories, secrets had made it into private repositories, and reporting channels for incidents affecting CISA itself were not well defined. CISA does not describe the attack in ATT&CK terms, and says the leaked credentials were not used outside its environments, so no intrusion technique is listed here.
Who says who was behind it
No public attribution. CISA describes an accidental exposure by a contractor and says the leaked credentials were not used outside CISA's environments.
Impact
CISA states that leaked credentials were not used outside of CISA's environments and that no customer or mission data was exposed.
CISA took its development environment offline and brought it back online after corrective actions. It gives no outage length.
CISA reports that key rotation took longer than anticipated because of the complexity of its systems and connections with federal and industry partners.
CISA had no GitHub/Cloud playbook and spent time building one in the early stages of the response.
The 19 May 2026 House Homeland Security Democrats page shows the exposure drew a congressional demand for a briefing.
Government and regulator response
- 15 May 2026, CISA: started incident response, took the repository offline and kept a copy, took the development environment offline, reset credentials and revoked the contractor’s access.
- Afterwards, CISA: rotated all credentials in every environment where the individual was an administrator, tuned allow and deny lists for code repositories, limited uploads to public repositories and brought the development environment back online.
- 19 May 2026, Congress: Representatives Thompson and Ramirez demanded a briefing from Acting Director Andersen, according to a page on the House Homeland Security Democrats site.
- 9 July 2026, CISA: published its lessons, including use of its EDR tool to manage uploads, an action plan for developer secrets, a new GitHub/Cloud playbook, refined reporting channels and key-management readiness.
Lessons
-
Treat outside reports as real
CISA says taking external reports seriously mattered. The researcher kept sharing information throughout the incident.
-
Make reporting easy
The researcher tried the contractor, CISA's disclosure platform and finally a reporter. CISA advises clear, separate channels for incidents affecting the organization itself, listed in several prominent places.
-
Guard development environments like production
CISA credits Zero Trust principles in development environments, plus visibility and alerting, for its response.
-
Control uploads to public repositories
CISA users could upload to public repositories. CISA now uses its EDR tool to manage this while still letting developers pull code.
-
Keep secrets out of repositories
CISA says no repository should contain secrets, yet secrets were in its private repositories. It rotated all secrets and made a plan to manage and monitor them.
-
Prepare playbooks and key rotation
CISA had no GitHub/Cloud playbook and its key rotation took longer than expected. It urges tested key-management capabilities.
What to check in your own organization
-
Early warning
Threat intelligence monitoring of exposed credentials could flag your keys or code in public repositories. In this case a researcher scanning public code found CISA's material before CISA knew. This is not a promise of detection.
-
Public repositories
Check whether staff and contractors can upload company code to public repositories, and how you would see it if they did.
-
Secrets in code
Scan private and public repositories for keys, passwords and tokens, and have a plan to remove and rotate what you find.
-
Contractor access
Review what cloud and code access contractors hold, and whether they work in managed environments.
-
Rotation readiness
Test how fast you can rotate every credential and key in an environment, including links to partners.
-
Playbooks
Check you have a written playbook for a leak on GitHub or in the cloud.
-
Reporting channels
Check researchers can find one clear way to report an incident that affects your own organization, not only product flaws.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
What happened at CISA in May 2026?
CISA says internal AWS GovCloud keys and other information were in a public repository owned by a contractor. It began incident response on 15 May 2026.
Who found it?
CISA says a security researcher whose company scans public code repositories found it and passed it to an investigative reporter, who contacted CISA.
Was any data stolen?
CISA says leaked credentials were not used outside its environments and no customer or mission data was exposed.
What did the contractor upload?
A copy of a CISA build and deployment repository, including Infrastructure as Code and build code, plus admin and build credentials.
What did CISA change?
It rotated credentials, tuned repository allow and deny lists, limited uploads to public repositories, and published lessons on 9 July 2026.
Who attacked CISA?
There is no public attribution. CISA describes an exposure by a contractor, not an intrusion.
In our research
- Most targeted EU sectors in 2025: the ENISA ranking October 2026
Sources
- Lessons from CISA's Cyber Incident CISA
- Thompson, Ramirez Demand Briefing After CISA Exposed Sensitive Government Credentials House Committee on Homeland Security Democrats
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.