Back Longbridge

US cyber agency CISA exposed reams of passwords and cloud keys to the open web

Longbridge • May 19, 2026

The U.S. cybersecurity agency CISA faced a significant security lapse when a researcher discovered exposed credentials on GitHub, allowing access to sensitive systems. The credentials, linked to a CISA contractor, included access tokens and cloud keys. Despite the breach, CISA has not confirmed any unauthorized use of the credentials. The incident raises concerns CISA's cybersecurity practices, especially as the agency has been without a permanent director since January 2025 and has seen workforce reductions.

Due to copyright restrictions, please log in to view. Thank you for supporting legitimate content.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Contractor Exposes Sensitive AWS Credentials on Public GitHub A contractor for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) left a public GitHub repository named 'Private-CISA' exposed for six months, containing sensitive credentials including AWS GovCloud access keys and internal CISA system passwords. Discovered by GitGuardian researcher Guillaume Valadon on May 14, 2026, the repository included files such as 'importantAWStokens' and 'AWS-Workspace-Firefox-Passwords.csv', which detailed access to critical infrastructure. The repository was created on November 13, 2025, and remained accessible until it was taken down on May 15, 2026, after Valadon alerted CISA. Despite the quick response, some credentials remained valid for an additional 48 hours, raising concerns about potential exploitation. CISA has stated there is currently no evidence that sensitive data was compromised as a result of the incident. The leak highlights significant lapses in security practices, especially given CISA's role in advising on cybersecurity. 33 sources 69

Extracted Entities

US cyber agency CISA exposed reams of passwords and cloud keys to the open web

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Platforms (1)