What we learned from CISA’s cyber incident

The federal Cybersecurity and Infrastructure Security Agency launched an internal incident response on May 15 after an investigative reporter alerted the agency that internal AWS GovCloud access keys and other materials tied to CISA were publicly accessible in an online code repository, according to a CISA account of the episode. The reporter had been contacted by a security researcher whose firm routinely scans public repositories.

CISA said its IT office moved quickly to contain the exposure. The public repository was taken offline and a copy preserved for analysis. Agency officials also disconnected the development environment, reset related credentials, and revoked the system access of the individual whose actions led to the exposure. The repository in question was not part of CISA’s official GitHub; it belonged to a contractor.

A review of the copied repository and supporting telemetry found that a contractor had uploaded duplicates of a CISA build and deployment repository to a personal GitHub account to stand up cloud infrastructure on their own. That material included infrastructure-as-code, build code, and both administrative and build credentials.

Forensic analysis determined the leaked credentials were not used outside CISA’s environments, and the agency reported no exposure of customer or mission data.

In the aftermath, CISA rotated all credentials across every environment where the individual held administrative privileges, tightened allow/deny lists for code repositories, and curtailed users’ ability to upload to public repositories. With those steps complete, the development environment was restored.

The agency also cataloged lessons from the incident. It credited granular zero-trust controls and robust logging for helping accelerate detection and response, while identifying areas to strengthen, including stricter controls on public repository uploads, better monitoring and management of developer secrets, and the need for comprehensive playbooks that cover cloud and GitHub scenarios. CISA said it is refining internal reporting channels to make it easier for outside researchers to report issues affecting the agency’s own systems, and is advancing efforts to consolidate developer environments for consistent guardrails. It also urged organizations to ensure cryptographic key agility, noting its own key-rotation effort took longer than expected due to system complexity and external interconnections.

CISA framed the disclosure as an effort to promote transparency and help other organizations bolster defenses, emphasizing that openly sharing incident details can highlight trends and improve collective awareness across the cybersecurity community.