‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) left its cloud storage repository containing passwords, tokens, and internal credentials publicly accessible on GitHub for approximately six months, according to a report from Krebs on Security. The leak was only fixed over the weekend. This incident exposes significant cybersecurity vulnerabilities within a key federal agency responsible for protecting U.S. infrastructure.

The exposed repository, named “Private-CISA,” contained files with sensitive information, including plaintext passwords, API tokens, and administrative credentials for Amazon AWS GovCloud servers and internal CISA systems. One file, titled ‘importantAWStokens,’ included administrative credentials to three AWS GovCloud servers, while another, ‘AWS-Workspace-Firefox-Passwords.csv,’ listed usernames and passwords for dozens of internal systems, including a system called ‘LZ-DSO,’ which appears to be CISA’s secure code development environment.

The repository was created in November of the previous year, and the vulnerability was present for about six months before it was discovered and fixed. CISA responded to the incident, stating, “Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”

Why It Matters

This incident underscores serious cybersecurity risks within a federal agency tasked with defending U.S. infrastructure from cyber threats. The exposure of internal credentials and tokens could have allowed malicious actors to access sensitive systems, potentially enabling cyber attacks or espionage. The leak also raises questions about federal cybersecurity practices and oversight, especially given CISA’s role in national security.

Background

CISA, established in 2018 under the Trump administration, has faced ongoing challenges, including leadership instability and funding cuts. The agency’s role is to coordinate cybersecurity efforts across government and private sectors. This incident follows a pattern of cybersecurity vulnerabilities in government agencies, but the scale and nature of this leak—exposing plaintext passwords and administrative credentials—are unprecedented in recent reports. Experts have noted that such leaks are rare and particularly damaging.

“This is the worst leak that I’ve witnessed in my career.”

— Guillaume Valadon, GitGuardian

“Currently, there is no indication that any sensitive data was compromised as a result of this incident.”

— CISA spokesperson

What Remains Unclear

It is still unclear how long the credentials were accessible before discovery, whether any malicious actors exploited the leak, or if additional sensitive data was compromised. The full scope of potential damage remains unknown as investigations continue.

What’s Next

CISA is expected to implement additional security measures to prevent similar leaks, including stricter access controls and routine audits of repositories. Further updates on the investigation and any potential breaches are anticipated in the coming weeks.

Key Questions

How did this leak happen?

The leak occurred because a GitHub repository containing sensitive credentials was left publicly accessible, with no restrictions on viewing or downloading the files. The repository was created in November of last year and was only secured after the breach was discovered over the weekend.

What kind of sensitive data was exposed?

The exposed files included plaintext passwords, API tokens, and administrative credentials for internal CISA systems and AWS GovCloud servers.

Could this have led to a cyber attack?

Potentially, yes. The exposure of administrative credentials and tokens could have allowed malicious actors to access internal systems, though there is no public evidence that this occurred.

What is CISA doing to prevent future leaks?

CISA has stated it is working to implement additional safeguards, including stricter access controls, security audits, and employee training to prevent similar incidents.

Source: reddit