Checkmarx Confirms LAPSUS$ Leaked Data from Its Private GitHub Repository
Summary
Checkmarx says LAPSUS$ published data it believes came from its private GitHub repository, accessed after a Trivy supply-chain attack linked to TeamPCP. Malicious KICS artifacts reportedly stole secrets; customer-data exposure remains under investigation.
Key points
- Checkmarx says data published by LAPSUS$ belonged to the company and originated from its private GitHub repository.
- The company believes repository access was facilitated by credentials exposed in a March 23 Trivy supply-chain attack attributed to TeamPCP.
- On April 22, attackers published malicious Docker images and VSCode and Open VSX extensions for Checkmarx’s KICS scanner that stole credentials, keys, tokens, and configuration files.
- Checkmarx says the leaked data does not contain customer information, but the exact data exposed is still being investigated.
- Access to the affected GitHub repository has been blocked pending the investigation.
- BleepingComputer reports that a 96GB data pack was available through clearnet portals; it says it did not examine the data.
Article Details
- Victim Organization
- Checkmarx
- Incident Type
- Supply-chain compromise followed by unauthorized access to Checkmarx’s private GitHub repository, publication of malicious artifacts that stole secrets, and a leak of repository data.
- Incident Date
- 2026-03-23
- Data Types Exposed
- Checkmarx GitHub repository data; the exact contents remain under investigation
- Credentials, keys, tokens, and configuration files were stolen by malicious Docker images and VSCode/Open VSX extensions
- Affected Data Size
- BleepingComputer reports that a 96GB data pack was made available through clearnet portals; the article does not establish that this is the size of confirmed exposed data.
- Operational Impact
- Checkmarx blocked access to the affected GitHub repository while a forensic investigation continues. Checkmarx stated that the repository does not store customer information.
- Ransom Or Extortion
- LAPSUS$ published the data on its extortion portal. No ransom demand is reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe article says attackers used credentials obtained from the Trivy incident to access Checkmarx’s GitHub repositories.T1195.002 · Compromise Software Supply ChainCheckmarx believes the initial access was facilitated by the Trivy supply-chain attack linked to TeamPCP.T1213.003 · Code RepositoriesThe attackers accessed Checkmarx’s private GitHub repository and data originating from it was later published.
Threat Actors
LAPSUS$Checkmarx confirmed that data originating from its private GitHub repository was published by LAPSUS$ on its extortion portal.TeamPCPCheckmarx believes the initial access was facilitated by the Trivy supply-chain attack attributed to TeamPCP; this attribution is presented as the company’s belief while the investigation continues.
Vendors
Products
KICSThe attackers published malicious Docker images and VSCode/Open VSX extensions for the KICS scanner that exfiltrated credentials, keys, tokens, and config files, and Checkmarx says the repository is blocked while aTrivyApplication security firm Checkmarx confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository after gaining credentials via a Trivy supply-chain attack linked to TeamPCP.