Reported CISA Credential Exposure on GitHub Prompts Congressional Questions
Summary
GitGuardian found a public GitHub repository reportedly exposing credentials for privileged AWS GovCloud accounts and CISA internal systems. CISA is investigating and says it has no indication sensitive data was compromised; lawmakers seek briefings.
Key points
- GitGuardian said it found a public GitHub repository exposing credentials for privileged AWS GovCloud accounts and internal CISA systems.
- The repository, reportedly maintained by a Nightwing contractor, was removed after the researcher alerted CISA.
- CISA says it is investigating and currently has no indication that sensitive data was compromised.
- House Democrats Bennie Thompson and Delia Ramirez, and Sen. Maggie Hassan, requested briefings on the exposure and CISA’s response.
- GitGuardian researcher Guillaume Valadon warned that a state actor obtaining the credentials could potentially gain persistence; this was a risk assessment, not a reported confirmed use.
- Researchers cited the incident as an example of the risks of accidentally exposing sensitive credentials in public repositories.
Article Details
- Victim Organization
- Cybersecurity and Infrastructure Security Agency (CISA)
- Incident Type
- Reported exposure of sensitive credentials in a public GitHub repository, apparently maintained by a contractor; no malicious access or subsequent compromise was confirmed.
- Data Types Exposed
- Credentials for privileged AWS GovCloud accounts
- Credentials for internal CISA systems
- Operational Impact
- CISA removed the repository after being alerted and is investigating. CISA said it had found no indication that sensitive data was compromised.
- Claim Status
- alleged
People
Ben HarrisWatchTowr founder who commented on the risks of inadvertently exposing sensitive credentials and the importance of safeguards.Bennie ThompsonMississippi representative and top Democrat on the House Homeland Security Committee; he requested a briefing from CISA about the reported exposure and its potential consequences.Dave MitchellInfoblox senior director of threat intelligence who commented on the need for controls and audits across repositories.Delia RamirezTop Democrat on the House Homeland Security Committee's cyber subcommittee; she joined a request for a CISA briefing about the reported exposure and its potential consequences.Guillaume ValadonGitGuardian security researcher who discovered the exposed repository and alerted CISA; he warned that a state actor obtaining the credentials could potentially gain persistence.Maggie HassanU.S. senator who requested a classified briefing from CISA about the systems exposed, its forensic work, and corrective actions.Nick AndersenCISA acting director who received congressional requests for briefings about the reported exposure.Travis RosiekRubrik public sector chief technology officer who commented on the incident and the need for federal government resilience.
Vendors
Products
AWS GovCloudCongressional Democrats are demanding answers after a public GitHub repository reportedly exposed sensitive CISA credentials tied to privileged AWS GovCloud accounts and internal systems.GitHubCongressional Democrats are demanding answers after a public GitHub repository reportedly exposed sensitive CISA credentials tied to privileged AWS GovCloud accounts and internal systems.