GitHub security incident history
Hacking, data breaches and other security incidents involving GitHub, with related coverage.
Hijacked GitHub accounts used to run data-stealing code in 1,806 repositories
Impact: 4,837 accounts abused, 61,764 repositories scanned, and data-stealing code executed in at least 1,806 repositories
In the wfx-loot cyber-attack observed since 10 November, 4,837 hijacked GitHub accounts were used to scan 61,764 repositories. The attackers ran credential-stealing code in at least 1,806 repositories, collecting keys for cloud, development and AI services through GitHub Actions, npm installation scripts and other means. The initial account compromise vector for the overall campaign has not been established.
Related reports: 7 · last report →Malicious extension infection leads to theft of 3,800 GitHub internal repositories
Impact: Data from 3,800 internal repositories
GitHub confirmed that data from 3,800 internal repositories was stolen in a breach carried out through a malicious Visual Studio Code extension. The infection occurred through an internal employee's device, and GitHub said customer data was not affected. TeamPCP, which claimed the attack, later took bids for the stolen data.
Related reports: 15 · last report →GitHub Copilot Chat flaw leaks private repository data
Impact: Private repository data
A flaw in GitHub Copilot Chat leaked data from private repositories. The scale of the leak, the date it occurred and specific response measures have not been confirmed.
Read on SecurityWeek ↗