Malicious extension infection leads to theft of 3,800 GitHub internal repositories
GitHub confirmed that data from 3,800 internal repositories was stolen in a breach carried out through a malicious Visual Studio Code extension. The infection occurred through an internal employee's device, and GitHub said customer data was not affected. TeamPCP, which claimed the attack, later took bids for the stolen data.
Key facts
- Affected organisation
- GitHub
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Data from 3,800 internal repositories
- Cause / method
- Infection of an internal employee's device via a malicious Visual Studio Code extension
- Location
- United States
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- GitHub confirmed a breach of 3,800 internal repositories and said customer data was not affected.
- It was reported that the infection occurred through an internal employee's device.
- The attacker claimed to have breached about 4,000 internal repositories and took bids for the stolen data.
15 related reports
- Attack on GitHub: Data from 3800 internal repositories stolen
- GitHub confirms being hacked by TeamPCP, says customer data unaffected
- Compromised coding tool helped hackers breach thousands of GitHub repositories
- GitHub Confirms Breach, 4K Internal Repos Stolen
- GitHub says hackers stole data from thousands of internal repositories
- GitHub admits major source code leak after 3,800 internal repositories breached
- GitHub Confirms Hack Impacting 3,800 Internal Repositories
- GitHub Confirms Breach of Internal Repositories Via Malicious VS Code Extension
- GitHub confirms breach of 3,800 repos via malicious VSCode extension
- A Malicious VS Code Extension Just Breached GitHub 's Internal Repositories
- GitHub investigates internal repositories breach claimed by TeamPCP
- 깃허브, 3800개 코드 저장소 해킹…내부 직원 기기 통해 감염
- 공급망 보안 우려 커지나...깃허브도 해킹 사정권에
- 깃허브, 대규모 내부 저장소 침해 사고…피해 액수는? [AI 인포그래픽]
- GitHub Hacker Claims Security Breach Involved About 4,000 Internal Repositories, Takes Bids on Stolen Data
Other incidents at GitHub
Hijacked GitHub accounts used to run data-stealing code in 1,806 repositories
Impact: 4,837 accounts abused, 61,764 repositories scanned, and data-stealing code executed in at least 1,806 repositories
In the wfx-loot cyber-attack observed since 10 November, 4,837 hijacked GitHub accounts were used to scan 61,764 repositories. The attackers ran credential-stealing code in at least 1,806 repositories, collecting keys for cloud, development and AI services through GitHub Actions, npm installation scripts and other means. The initial account compromise vector for the overall campaign has not been established.
Related reports: 7 · last report →GitHub Copilot Chat flaw leaks private repository data
Impact: Private repository data
A flaw in GitHub Copilot Chat leaked data from private repositories. The scale of the leak, the date it occurred and specific response measures have not been confirmed.
Read on SecurityWeek ↗
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.