TECHNOLOGY

Washington agency admits security lapses in GovCloud leak

▪

Read, Watch or Listen

WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has acknowledged major internal security and procedural failures in its handling of a significant credential leak tied to its GovCloud infrastructure. In a detailed after-action forensic report released on Thursday, July 9, 2026, the agency disclosed that it had no formal incident response playbook ready when the crisis emerged and was forced to draft mitigation procedures in real time as the situation unfolded. The admission has drawn heightened scrutiny because CISA is the federal government’s lead agency for protecting critical infrastructure and advising both public and private organizations on cybersecurity best practices, and has long promoted strict security hygiene and “Secure by Design” principles across federal networks. WASHINGTON — According to the report, the incident began on May 15, 2026, when CISA’s Office of the Chief Information Officer was contacted by an investigative reporter about a public GitHub repository titled “Private-CISA.” The repository, which had been accessible on the open web since November 13, 2025, was maintained by an employee of Nightwing, a government defense contractor based in Dulles, Virginia. The contractor had uploaded copies of a CISA build and deployment repository to a personal GitHub account in an attempt to set up cloud infrastructure outside official agency workflows. Forensic analysis of the 844-megabyte repository found a large collection of highly sensitive credentials and internal files, including administrative credentials to three Amazon Web Services GovCloud accounts.

Prepared by Jonathan Pierce and reviewed by editorial team.

Timeline of Events

Nov 13, 2025 Nightwing employee creates GitHub repository
Nov 13, 2025 CISA build data uploaded publicly
Nov 13, 2025 Sensitive credentials inadvertently exposed online
May 15, 2026 Reporter alerts CISA about repository
May 2026 CISA begins crisis response efforts
May 2026 Mitigation procedures drafted during incident
Jul 9, 2026 CISA publishes after-action forensic report
Jul 2026 Internal security lapses publicly acknowledged

Why This Matters to You

This incident exposes a gap in our nation's cybersecurity, potentially putting your data at risk. If you're a federal employee or contractor, double-check your security protocols. If you're a citizen, be aware of potential phishing attempts.

The Bottom Line

CISA, the agency tasked with protecting our critical infrastructure, had a significant security lapse. It's a stark reminder that even the experts can falter. Worth forwarding if you know someone in the cybersecurity field.