GitHub Internal Repos Breached; Binance’s CZ Urges Urgent Key Rotation

TL;DR

Hackers breached GitHub's internal repositories by exploiting a tainted VS Code extension on an employee's computer. A group named TeamPCP is allegedly selling around 4,000 private repositories for at least $50,000.

Key points

Hackers accessed GitHub's internal repositories
Exploited a tainted VS Code extension
TeamPCP claims to sell 4,000 private repositories
Minimum asking price is $50,000
No evidence of customer data access confirmed

Mentioned in this story

GitHub

TeamPCP

Earlier today, hackers gained access to GitHub’s internal repositories by exploiting an employee’s computer with the use of a tainted VS Code extension.

Following the incident, reports emerged that a threat actor using the alias TeamPCP was now allegedly selling what they claim is roughly 4,000 of GitHub’s private repositories on a cybercriminal forum, with a minimum asking price of $50,000.

What GitHub Says Happened

GitHub confirmed the breach through several tweets posted on its X account, where it detailed what it knew thus far. As per the hosting platform, the attacker gained access to its internal repository via a malicious extension of VS Code loaded onto one of the devices of its employees.

GitHub claims that once it realized there was an attack, it promptly deleted the malicious software from the infected machine. Critically, it pointed out that there is currently no evidence that customer data held outside its internal systems, meaning individual users’ enterprises, organizations, or repositories, was accessed.

The hosting service also confirmed it moved quickly to rotate credentials, moving the highest-impact secrets first. It will also be examining logs to see whether there has been any additional activity, and it will be providing more details on the matter after the investigation concludes.

Meanwhile, French researcher Sébastien Latombe flagged a listing on a criminal message board by a threat actor calling themselves “TeamPCP,” claiming to be the one behind the hack, containing mentions of repositories related to GitHub Actions, GitHub Enterprise, GitHub Copilot, Azure, CodeQL, billing, and authentication services.

Allegedly, they are not looking to ransom GitHub but want a single buyer for the stolen data, with the minimum asking price being $50,000.

However, it must be noted that there has been no official confirmation of the content in the forum listing from GitHub or Microsoft, and any claims made in such cybercriminal sites may be taken with a pinch of salt, as any data they provide in such cases may be out of date or overblown to inflate its perceived value.