InfoSecBulletin Cybersecurity for mankind
One of the most egregious government data leaks in recent history might be the recent leak of Cybersecurity & Infrastructure Security Agency (CISA) public GitHub repository maintained by a contractor that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.
Security experts said the public archive had files about how CISA makes, tests, and uses software inside the organization.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
On May 15, KrebsOnSecurity got a message from Guillaume Valadon, a researcher at GitGuardian. His company always checks public code sites like GitHub for exposed secrets and alerts the accounts if they find sensitive data. Valadon contacted KrebsOnSecurity because the owner wasn’t replying and the exposed information was very sensitive.
The “Private-CISA” repository was open to the public until mid-May 2026. It held a lot of sensitive information like AWS GovCloud login info, plain passwords, API keys, and internal system details.
A file called “AWS-Workspace-Firefox-Passwords.csv” showed many usernames and passwords in plain text linked to CISA systems. This includes a DevSecOps area known as “LZ-DSO.”
Philippe Caturegli, founder of security consultancy Seralys said, some of the exposed AWS credentials were still valid at the time of discovery and provided high-level access. He noted that the repository also contained credentials for CISA’s internal “artifactory,” a centralized system for storing and distributing software components.
This type of access could allow attackers to insert malicious code into software pipelines.
KrebsOnSecurity said that the exposed data was connected to a contractor from Nightwing, a government services company in the U.S. The account had been open since 2018, and the “Private-CISA” folder was set up in November 2025.
CISA acknowledged saying that:
“Currently, there is no indication that any sensitive data was compromised as a result of this incident[…] While we hold our team members to the highest standards of integrity and operational awareness, we are working to ensure additional safeguards are implemented to prevent future occurrences.”
