Checkmarx Confirms Data Exfiltration After Supply Chain Attack
Summary
Checkmarx confirmed data was exfiltrated on March 30 after attackers used credentials stolen in the Trivy supply-chain attack. Lapsus$ later claimed a 96GB archive of stolen data; Checkmarx says it is investigating and has taken containment and credential-reset measures
Key points
- Checkmarx said data exfiltration occurred on March 30, after attackers used credentials compromised in the March 23 Trivy supply-chain attack to access its GitHub environment.
- The attack attributed to TeamPCP hijacked dozens of GitHub Action version tags to reference malware without visible changes.
- Attackers poisoned two OpenVSX plugins and two GitHub Actions workflows; on April 22, they published further malicious code through a DockerHub KICS image, a GitHub action, a VS Code extension, and a Developer Assist extension.
- Lapsus$ listed Checkmarx on its leak site and claimed to have stolen source code, employee databases, API keys, and MongoDB and MySQL credentials. The group also claimed a 96GB archive; these claims are attributed, not independently confirmed in the article.
- The later Checkmarx incident compromised the Bitwarden CLI NPM package.
- Checkmarx said it removed malicious packages, rotated credentials, blocked outbound access to attacker infrastructure, tightened GitHub repository access, and launched a code audit. It retained Mandiant and notified law enforcement.
Article Details
- Victim Organization
- Checkmarx
- Incident Type
- Supply chain compromise resulting in data exfiltration
- Incident Date
- 2026-03-23
- Data Types Exposed
- Data exfiltration was confirmed by Checkmarx; Lapsus$ claimed the stolen data included source code, employee databases, API keys, and MongoDB and MySQL credentials.
- Affected Records
- Unknown
- Affected Data Size
- Lapsus$ published a 96GB archive that it claimed was stolen from Checkmarx.
- Operational Impact
- Attackers accessed Checkmarx’s GitHub environment using credentials compromised in the Trivy supply chain attack, poisoned plugins and workflows, and later published additional malicious code through compromised software artifacts. Checkmarx said data exfiltration took place on 2026-03-30. The company removed malicious packages, revoked and rotated credentials, blocked outbound access to attacker infrastructure, notified law enforcement, retained Mandiant, strengthened access controls, and audited code. A later incident also compromised the Bitwarden CLI NPM package.
- Ransom Or Extortion
- Lapsus$ added Checkmarx to its leak site and published a 96GB archive it claimed was stolen. No ransom demand is reported.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
LAPSUS$Lapsus$ claimed that data stolen from Checkmarx included source code, employee databases, API keys, and database credentials, and published a 96GB archive it claimed was stolen. Messages from TeamPCP and Lapsus$ suggested they might have partnered for monetization, but this was not confirmed.TeamPCPThe article attributes the supply chain compromise to TeamPCP and describes it as part of a campaign targeting open source ecosystems to steal credentials and sensitive information.
Vendors
CheckmarxCheckmarx on Tuesday confirmed that last month’s supply chain attack targeting its KICS open source project also resulted in data theft.MandiantAs part of its ongoing efforts to remedy the issue, the company notified law enforcement, retained Mandiant to assist with the investigation, performed a broader credential reset, strengthened security controls, locked
Products
Developer Assistof malicious code by poisoning a DockerHub KICS image, a GitHub action, a VS Code extension, and a Developer Assist extension.Docker Hubaccess to the environment, and on April 22, published a fresh round of malicious code by poisoning a DockerHub KICS image, a GitHub action, a VS Code extension, and a Developer Assist extension.GitHub ActionsThe hackers accessed Checkmarx’s GitHub environment using credentials compromised via the Trivy hack on March 23 and poisoned two OpenVSX plugins and two GitHub Actions workflows.KICSCheckmarx on Tuesday confirmed that last month’s supply chain attack targeting its KICS open source project also resulted in data theft.OpenVSXThe hackers accessed Checkmarx’s GitHub environment using credentials compromised via the Trivy hack on March 23 and poisoned two OpenVSX plugins and two GitHub Actions workflows.TrivyThe compromise was a result of the Trivy supply chain attack and allowed the attackers to hijack dozens of GitHub Action version tags to reference malware without visible changes.VS Code22, published a fresh round of malicious code by poisoning a DockerHub KICS image, a GitHub action, a VS Code extension, and a Developer Assist extension.