Washington agency admits security lapses in GovCloud leak
PUBLISHED Jul 13, 2026, 6:32 AM ET
Read, Watch or Listen
WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has acknowledged major internal security and procedural failures in its handling of a significant credential leak tied to its GovCloud infrastructure. In a detailed after-action forensic report released on Thursday, July 9, 2026, the agency disclosed that it had no formal incident response playbook ready when the crisis emerged and was forced to draft mitigation procedures in real time as the situation unfolded. The admission has drawn heightened scrutiny because CISA is the federal government’s lead agency for protecting critical infrastructure and advising both public and private organizations on cybersecurity best practices, and has long promoted strict security hygiene and “Secure by Design” principles across federal networks. WASHINGTON — According to the report, the incident began on May 15, 2026, when CISA’s Office of the Chief Information Officer was contacted by an investigative reporter about a public GitHub repository titled “Private-CISA.” The repository, which had been accessible on the open web since November 13, 2025, was maintained by an employee of Nightwing, a government defense contractor based in Dulles, Virginia. The contractor had uploaded copies of a CISA build and deployment repository to a personal GitHub account in an attempt to set up cloud infrastructure outside official agency workflows. Forensic analysis of the 844-megabyte repository found a large collection of highly sensitive credentials and internal files, including administrative credentials to three Amazon Web Services GovCloud accounts.
By Emily Rhodes | JQJO News
Timeline of Events
- Nov 13, 2025 Nightwing employee creates GitHub repository
- Nov 13, 2025 CISA build data uploaded publicly
- Nov 13, 2025 Sensitive credentials inadvertently exposed online
- May 15, 2026 Reporter alerts CISA about repository
- May 2026 CISA begins crisis response efforts
- May 2026 Mitigation procedures drafted during incident
- Jul 9, 2026 CISA publishes after-action forensic report
- Jul 2026 Internal security lapses publicly acknowledged
News Intelligence
- This incident exposes a gap in our nation's cybersecurity, potentially putting your data at risk. If you're a federal employee or contractor, double-check your security protocols. If you're a citizen, be aware of potential phishing attempts.
Comments