‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
CISA, the U.S. cybersecurity agency, accidentally left AWS GovCloud credentials, plaintext passwords, and authentication tokens in a public GitHub repository named 'Private-CISA' for approximately six months. The exposed files included admin credentials to three AWS GovCloud servers and a CSV file with plaintext usernames and passwords for dozens of internal CISA systems, including its secure code development environment. The leak was discovered by GitGuardian's Guillaume Valadon, who called it the worst leak he had witnessed in his career. The incident is attributed to a Nightwing contractor employee who appeared to be using GitHub to transfer files between work and home devices. CISA stated there is no indication sensitive data was compromised and pledged additional safeguards.
