Cyber Incident Victim: GitHub
Date:
Jun 2016
Location:
United States of America
Summary
Unauthorized attempts to access numerous accounts occurred via credential stuffing, leveraging compromised credentials from unrelated third-party services. The platform confirmed no direct breach of its systems but detected successful logins to some accounts, potentially exposing usernames, passwords, and repository or organizational metadata for impacted users. Affected accounts underwent password resets, with direct notifications sent to users about restoration steps. The incident highlighted risks associated with password reuse across services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 14, 2016, GitHub disclosed an incident involving unauthorized access attempts to user accounts detected the prior evening (June 13, 2016 PST). The attackers leveraged credential stuffing techniques, utilizing email addresses and passwords previously exposed in breaches of unrelated third-party services to systematically test login credentials on GitHub accounts. GitHub's investigation confirmed successful unauthorized logins to an unspecified number of accounts, though the company emphasized its own systems remained uncompromised. The attackers gained access to usernames and passwords for affected accounts. For some compromised accounts, additional personal information—specifically listings of accessible repositories and organizations—was potentially exposed to the threat actors. GitHub initiated password resets for all impacted accounts as a containment measure following the discovery.
The incident did not involve exploitation of vulnerabilities within GitHub's infrastructure but rather exploited the reuse of compromised credentials across multiple services. GitHub undertook direct notification of affected users, providing instructions for password restoration and account recovery. The company publicly characterized the event as part of an evolving attack pattern, committing to continued investigation and monitoring for emerging threats. Impacted users were restricted to those whose credentials matched those exposed in prior third-party breaches and who had reused those credentials on GitHub. No technical details regarding the volume of affected accounts, attacker origins, or specific data exfiltrated beyond repository/organization listings were disclosed in the public advisory. GitHub's response focused on credential reset procedures and user awareness of credential reuse risks without disclosing further forensic findings.