The CISA has published a forensic analysis report examining a major credential leak discovered in May 2026, in which a contractor inadvertently exposed AWS credentials on a personal GitHub account, leading to a significant security incident affecting government systems.
The post-incident analysis details how the credential exposure occurred through a contractors personal GitHub repository that contained hardcoded access keys for AWS GovCloud environments. The report outlines the attack timeline, from the initial exposure to the subsequent unauthorized access, and provides recommendations for preventing similar incidents. The leaked credentials were discovered by security researchers who reported them through Cisas coordinated vulnerability disclosure program.
The report emphasizes the need for strict separation between personal and professional development environments, particularly for contractors with access to government systems. Recommendations include implementing credential scanning in CI pipelines, enforcing hardware security key requirements for all cloud access, and conducting regular audits of GitHub repositories belonging to personnel with government IT access. The incident has prompted CISA to revise its contractor security requirements.
HTMLEOF
