Story perspectives

CISA Deletes Private Repo After Six-Month Credential Leak

5/20/2026

Summary

CISA Removes Repo

CISA removed the “Private-CISA” GitHub repository about 26 hours after GitGuardian flagged it on May 14 2026.
The repository, created on November 13 2025, exposed admin credentials and AWS GovCloud keys for roughly six months.
Some of the exposed AWS GovCloud keys remained valid for 48 hours after the repository was deactivated.
CISA said there is currently no indication that any sensitive data was compromised.

Summary

Nightwing Leaks Passwords

Nightwing, a subcontractor in Dulles, Virginia, leaked internal passwords and plaintext authentication data from CISA’s Artifactory repository.
The passwords used a simple pattern of the platform name plus the current year, a practice experts call risky.
CISA has lost nearly a third of its workforce since President Donald Trump’s second term began, after acting director Madhu Gottumukkala posted sensitive documents to ChatGPT in early 2026, creating another security mishap.

Summary

CISA Leaks Credentials

The cyber-defense agency posted its own admin credentials, creating a leak.
The file “AWS-Workspace-Firefox-Passwords.csv” contained passwords for LZ-DSO, the agency’s Landing Zone DevSecOps platform.
The credentials stayed public for six months, turning ordinary files into a persistent adversary risk.
Experts warn contractors to audit public repositories, citing CISA’s safeguards as under scrutiny for preventing another multi-month cloud-key leak.

Summary

Trump Cuts CISA

President Donald Trump’s administration plans major budget cuts for CISA after a credential leak.
CISA is portrayed as chaotic, with multiple senior leadership posts still vacant.
A cyber-security analyst who tracks leaks called the breach the worst he has seen.
The contractor uploaded the files to GitHub using unsecured methods, revealing that CISA lacked standard tools to auto-detect such exposures.

History

Historical Context

In June 2015 the Office of Personnel Management disclosed a breach that exposed about 22 million federal personnel records, including SF-86 security-clearance data. State-sponsored hackers linked to China infiltrated OPM’s network, prompting resignations of director Katherine Archuleta and CIO Donna Seymour and spurring congressional criticism of warnings. FBI Director James Comey called the theft a security threat, and a March 2015 Inspector General report had warned of security deficiencies.

1 of 5

CISA Removes Repo

CISA removed the “Private-CISA” GitHub repository about 26 hours after GitGuardian flagged it on May 14 2026.
The repository, created on November 13 2025, exposed admin credentials and AWS GovCloud keys for roughly six months.
Some of the exposed AWS GovCloud keys remained valid for 48 hours after the repository was deactivated.
CISA said there is currently no indication that any sensitive data was compromised.

1 / 5