Checkmarx Says Data From GitHub Repository Was Posted on Dark Web After Supply-Chain Attack
Summary
Checkmarx says data posted on the dark web appears to have come from a GitHub repository accessed during the March 23 supply-chain attack. The repository is separate from production; forensics continue, and the company says it stores no customer data.
Key points
- Checkmarx says current evidence indicates data posted on the dark web originated from a company GitHub repository accessed during the March 23, 2026 supply-chain attack.
- The company says the repository is separate from its customer production environment and stores no customer data; it is still verifying the nature and scope of the posted data.
- Checkmarx locked down access to the repository and says it will notify customers if it determines customer information was involved.
- Dark Web Informer reported that a LAPSUS$ data-leak-site listing named Checkmarx and claimed to include source code, an employee database, API keys, and MongoDB/MySQL credentials.
- The earlier Trivy-related supply-chain incident involved tampering with two GitHub Actions workflows and two Open VSX plugins to distribute a credential stealer; TeamPCP claimed responsibility.
- The article says a suspected later compromise involved Checkmarx’s KICS Docker image, VS Code extensions, and a GitHub Actions workflow, and briefly affected the Bitwarden CLI npm package.
Article Details
- Victim Organization
- Checkmarx
- Victim Domain
- Unknown
- Incident Type
- Supply-chain attack followed by publication of company-related data reportedly originating from a Checkmarx GitHub repository.
- Incident Date
- 2026-03-23
- Data Types Exposed
- Checkmarx confirmed that company-related data was published on the dark web. A leak-site listing attributed to LAPSUS$ reportedly described the data as source code, an employee database, API keys, and MongoDB/MySQL credentials; Checkmarx had not verified the nature and scope of the posted data.
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Checkmarx locked down access to the affected GitHub repository while forensic analysis continued. The repository is separate from its customer production environment and, according to Checkmarx, does not store customer data. The wider supply-chain incident involved tampering with GitHub Actions workflows and VS Code extensions to distribute credential-stealing malware, and briefly affected the Bitwarden CLI npm package. Checkmarx had not determined whether customer information was involved.
- Ransom Or Extortion
- A leak-site listing attributed to LAPSUS$ claimed Checkmarx as a victim. No ransom demand or payment was reported.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Vendors
Bitwarden#Checkmarx #LAPSUS$CheckmarxCheckmarx says its investigation into the supply chain security incident found data related to the company was published on the dark web and that current evidence indicates the data originated from a Checkmarx GitHubGitHubwas published on the dark web and that current evidence indicates the data originated from a Checkmarx GitHub repository accessed via the March 23, 2026 attack.
Products
Bitwarden CLIThreat actors LAPSUS$ and TeamPCP have been linked to the wider incident, which involved Trivy-related tampering and impacted KICS, VS Code extensions, GitHub Actions workflows, and briefly the Bitwarden CLI npm package.GitHub ActionsThreat actors LAPSUS$ and TeamPCP have been linked to the wider incident, which involved Trivy-related tampering and impacted KICS, VS Code extensions, GitHub Actions workflows, and briefly the Bitwarden CLI npm package.Open VSXattack, as a result of which two of its GitHub Actions workflows and two plugins distributed via the Open VSX marketplace were tampered with to push a credential stealer capable of harvesting a wide range ofVS Code extensionsThreat actors LAPSUS$ and TeamPCP have been linked to the wider incident, which involved Trivy-related tampering and impacted KICS, VS Code extensions, GitHub Actions workflows, and briefly the Bitwarden CLI npm package.