CISA Contractor Apparently Leaked 'Highly Sensitive' Government AWS Keys on Github

SSH keys, plaintext passwords, other sensitive data had been up since November 2025.

The leak was so bad, researchers initially thought it was a joke.

The federal cybersecurity agency left plaintext passwords in a spreadsheet uploaded to a public GitHub repository, per a report by independent journalist Brian Krebs.

In a striking case of doing the opposite of what it's supposed to do, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) left its most sensitive digital passwords sitting in plain sight on the public internet for months.Think of it like this: imagine the agency that's supposed to protect America's digital locks accidentally left all the keys to those locks sitting in a public park. And worse, the keys had labels on them that said e…

Passwords were stored as plain text in a public GitHub repository.

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data lea…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage