type: incident · created: 2026-07-18 · updated: 2026-07-18 · tags: [incident, cisa, data-leak, github, credentials, postmortem] · confidence: high · affected_sectors: [government] · au_impact: true
Lessons Learned from CISA's Recent GitHub Leak
CISA published a postmortem on a data leak in which a contractor published 844 MB of sensitive internal data — including AWS GovCloud keys and plaintext passwords for dozens of internal systems — in a public GitHub repository for nearly six months.
| Attribute | Detail |
|---|---|
| Data | 844 MB incl. AWS GovCloud keys, plaintext passwords |
| Exposure window | ~6 months in a public GitHub repo |
| Detection | GitGuardian sent 9 automated alerts; KrebsOnSecurity notified CISA in May 2026 |
| Response | CISA took 48+ hours to rotate keys; outlined improved reporting channels |
| Source | Krebs on Security — Tier 2/4 |
The postmortem is a benchmark for third-party contractor access and cloud-credential hygiene — a reminder that sensitive keys and plaintext credentials must never sit in public repositories and that automated secret-scanning alerts need an effective human triage path.