Capitol Hill lawmakers are seeking explanations from the U.S. Cybersecurity & Infrastructure Security Agency following revelations that one of its contractors deliberately posted AWS GovCloud credentials and sensitive agency information to a public GitHub repository. The controversy arrives as CISA grapples with containing the breach and revoking the exposed access credentials.
On May 18, security reporting disclosed that a CISA contractor possessing administrative privileges on the agency's code development infrastructure had set up a public GitHub profile named "Private-CISA" containing plaintext credentials for numerous internal CISA systems. Security researchers examining the leaked materials observed that the repository's commit history indicated the contractor had deliberately turned off GitHub's default safeguards designed to block the publication of sensitive credentials in public repositories.
While CISA acknowledged the incident occurred, the agency has declined to specify how long the data remained exposed. According to security analysts who studied the now-deleted Private-CISA archive, the repository was initially established in November 2025 and displayed characteristics suggesting the contractor was using it as a personal working environment or file synchronization tool rather than as an official project repository.
CISA stated that "there is no indication that any sensitive data was compromised as a result of the incident." Nevertheless, in a May 19 letter to CISA's Acting Director Nick Andersen, Sen. Maggie Hassan (D-NH) expressed alarm that such a security failure could happen within the organization responsible for safeguarding the nation's cyber infrastructure.
This reporting raises serious concerns regarding CISA's internal policies and procedures at a time of significant cybersecurity threats against U.S. critical infrastructure
Sen. Maggie Hassan
Hassan attributed the breach partly to significant upheaval at CISA, where the Trump administration's forced early retirements, severance packages, and departures eliminated more than one-third of the workforce and nearly all top-level management across multiple departments.
Rep. Bennie Thompson (D-MS), the ranking member of the House Homeland Security Committee, voiced similar worries in his own May 19 correspondence to the acting CISA director, which was also signed by Rep. Delia Ramirez (D-Ill), the ranking member of the panel's Subcommittee on Cybersecurity and Infrastructure Protection.
We are concerned that this incident reflects a diminished security culture and/or an inability for CISA to adequately manage its contract support. It's no secret that our adversaries — like China, Russia, and Iran — seek to gain access to and persistence on federal networks. The files contained in the 'Private-CISA' repository provided the information, access, and roadmap to do just that.
Rep. Bennie Thompson
According to reporting, more than a week after the security firm GitGuardian alerted CISA to the breach, the agency continues working to deactivate and refresh numerous compromised keys and credentials.
On May 20, Dylan Ayrey, creator of TruffleHog—an open-source utility for locating private keys and other secrets embedded in code on GitHub and comparable platforms—indicated that CISA had not yet revoked an RSA private key that was part of the Private-CISA repository. This key provided entry to a GitHub application controlled by the CISA enterprise account and deployed across the CISA-IT GitHub organization with unrestricted access to all code repositories.
An attacker with this key can read source code from every repository in the CISA-IT organization, including private repos, register rogue self-hosted runners to hijack CI/CD pipelines and access repository secrets, and modify repository admin settings including branch protection rules, webhooks, and deploy keys.
Dylan Ayrey
CI/CD, which stands for Continuous Integration and Continuous Delivery, encompasses a collection of methods for automating the creation, validation, and rollout of software applications.
After KrebsOnSecurity brought Ayrey's observations to CISA's notice on May 20, the agency appears to have deactivated the exposed RSA private key. However, Ayrey pointed out that CISA has yet to refresh credentials connected to other vital security systems deployed throughout its infrastructure, which are not being publicly identified at this time.
CISA issued a brief response stating, "CISA is actively responding and coordinating with the appropriate parties and vendors to ensure any identified leaked credentials are rotated and rendered invalid and will continue to take appropriate steps to protect the security of our systems."
Ayrey explained that Truffle Security continuously scans GitHub and other code repositories for exposed keys and notifies affected parties of the leaks. GitHub facilitates this monitoring by maintaining a public stream of all commits and modifications to public repositories. However, Ayrey cautioned that malicious actors similarly track these public feeds and frequently exploit API or SSH keys that are unintentionally shared in code commits.
It is probable that criminal organizations or state-sponsored adversaries also detected the exposure of these CISA secrets, with the most serious disclosures appearing to have taken place in late April 2026, according to Ayrey.
We monitor that firehose of data for keys, and we have tools to try to figure out whose they are. We have evidence attackers monitor that firehose as well. Anyone monitoring GitHub events could be sitting on this information.
Dylan Ayrey
James Wilson, enterprise technology editor for the Risky Business security podcast, noted that organizations managing code on GitHub can implement organizational-level policies preventing staff from circumventing GitHub's built-in protections against credential exposure. Yet Wilson's co-host Adam Boileau raised doubts about whether technical measures could prevent contractors from establishing independent GitHub accounts to store confidential materials.
Ultimately, this is a thing you can't solve with a technical control. This is a human problem where you've hired a contractor to do this work and they have decided of their own volition to use GitHub to synchronize content from a work machine to a home machine. I don't know what technical controls you could put in place given that this is being done presumably outside of anything CISA managed or even had visibility on.
Adam Boileau
Source: Krebs on Security