Checkmarx Confirms GitHub Repository Data Published on Dark Web

Cybersecuritynews •Abinaya • April 28, 2026

Application security testing firm Checkmarx has confirmed a significant escalation in its ongoing security incident. Cybercriminals have officially published company data on the dark web. This new development directly ties back to a supply chain attack that initially compromised the company’s systems on March 23, 2026. Working alongside a leading third-party forensic firm, Checkmarx traced […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Checkmarx Data Leak Linked to Supply-Chain Attack by TeamPCP Checkmarx, a software security firm, is investigating a significant data leak after its GitHub repository was compromised in a supply-chain attack on March 23, 2026. The attack, attributed to the TeamPCP cybercrime group, involved the injection of credential-stealing malware into Checkmarx's KICS tool, which allowed unauthorized access to sensitive company data. The leaked information includes source code, API keys, and employee details, posing a risk to client projects. Checkmarx has locked down the affected repository and is working to assess the scope of the breach. The incident highlights vulnerabilities in DevOps environments where third-party integrations can expose sensitive credentials. The attackers initially compromised Trivy, an open-source vulnerability scanner, to gain access to Checkmarx's systems. As of April 27, 2026, Checkmarx has not confirmed the full extent of the data leak but is expected to provide updates soon. 8 sources 71

Checkmarx Confirms GitHub Repository Data Published on Dark Web

The full story

Extracted Entities

Attack Types (1)

Companies (1)