The Agency That Tells You to Protect Your Credentials Just Left Theirs on GitHub. Here's What It Means for Your Business.
On May 14, 2026, a security researcher found 844 megabytes of US government credentials sitting in a public GitHub repository named "Private-CISA." The credentials belonged to CISA — the agency whose job is to tell businesses how to protect their credentials. The five lessons from this story apply directly to every SMB in America.
The files were named with a frankness that made security researchers do a double-take. One was called "importantAWStokens." Another was "AWS-Workspace-Firefox-Passwords.csv" — a spreadsheet listing plaintext usernames and passwords for dozens of internal government systems. Both were sitting in a public GitHub repository that anyone on the internet could read, download, and use.
The repository had been there since November 13, 2025. For six months, credentials granting high-level administrative access to US government cloud infrastructure were publicly accessible. Not hidden in a dark web marketplace. Not stolen by a nation-state actor. Just sitting there, in plain text, in a folder someone named "Private-CISA" — apparently under the impression that naming a repository "private" makes it private.
The repository belonged to a contractor working for CISA — the Cybersecurity and Infrastructure Security Agency — the branch of the US government whose specific mandate is to improve the nation's cybersecurity posture. The same agency that publishes guidance telling American businesses how to protect their credentials.
What actually happened — the timeline
What the files actually contained
The specific files in the "Private-CISA" repository tell the story clearly:
The Artifactory access deserves specific attention. Artifactory is a repository of all the software packages an organization uses to build its applications. Access to CISA's Artifactory would allow an attacker to insert malicious code into software packages — meaning every future build CISA deploys would contain the attacker's backdoor. That's not a credential breach. That's a supply chain attack on US cybersecurity infrastructure.
The five lessons that apply directly to your business
The most dangerous credential threats come from people, not hackers
Human errorNo nation-state actor breached CISA. No zero-day exploit was used. A contractor needed to move files between a work laptop and a home computer and chose the path of least resistance. This is the same pattern as 84% of insider incidents: not malice, not sophistication — just someone solving a convenience problem without thinking about security consequences.
Every one of your employees has done something similar or will do it. Without clear policy, approved tools, and monitoring for where sensitive data ends up, your credentials are one convenience decision away from the same outcome.
Disabling security controls is the most dangerous action any employee can take
Control bypassThe contractor deliberately disabled GitHub's secret scanning feature — which exists specifically to prevent sensitive data from being published to public repositories. The commit logs show this was an explicit action. The security control was there. Someone turned it off because it was inconvenient.
In your business: disabling MFA because login is annoying. Turning off automatic updates because the reboot is inconvenient. Exempting admin accounts from password policy because they're trusted. Every deliberate bypass of a security control is a CISA-scale incident waiting to happen at a smaller scale.
Six months of undetected exposure is not unusual — it's the documented average
Detection gapCISA had no internal monitoring that caught this in 180 days. IBM's 2025 research documents the average credential breach detection time at 292 days. CISA outperformed the average — and it still took six months. The detection didn't come from internal monitoring. It came from GitGuardian — a commercial tool that continuously scans public repositories from the outside.
Taking down the leak doesn't end the exposure
Remediation gapAfter the repository was taken down, CISA's AWS credentials remained valid for 48 hours. Anyone who had accessed those credentials during the six-month window could still use them after the repo was gone. Deleting the source of the leak doesn't invalidate the credentials that were in it.
If it can happen to CISA, it will happen to businesses that take fewer precautions
The upsideCISA has a dedicated security team, sophisticated tooling, and a workforce whose entire job is cybersecurity. They still had a contractor disable secret scanning, store passwords in plain text, and expose government infrastructure for six months. The incident wasn't caused by lack of knowledge — it was caused by the gap between policy and practice.
The upside: the controls that would have prevented this are not sophisticated. A properly configured secret scanning requirement that employees cannot disable would have caught it. A policy that provides approved sync tools would have prevented it. A monitoring system that catches publicly exposed credentials would have detected it. All three are achievable at SMB scale.
The question your business should be asking right now
The CISA story ends with a statement that will sound familiar: "Currently, there is no indication that any sensitive data was compromised." This is not reassurance. This is the default statement issued when an organization doesn't yet know the extent of the damage. CISA has no way to know who accessed those credentials during six months of public exposure. Neither do you, if a credential from your business has been sitting in a breach database.
The parallel for small businesses isn't dramatic. It's quiet. A former employee's account still active. A password stored in a shared spreadsheet. A vendor with access that was never revoked. A credential in HIBP that nobody checked. None of these feel like "the worst leak a researcher has witnessed in their career." They feel like administrative tasks that never made it to the priority list.
The CISA contractor didn't think they were doing anything wrong. They were solving a problem. The five checks in this series close those gaps — not because they're sophisticated, but because they're the fundamentals that even the most sophisticated organizations fail to maintain.
📚 Credential Security Series — Read the full series
See what's publicly visible about your domain — before someone else does. Veriti Spottr's beta is free.
Join the free beta →
Comments
Post a Comment