MalwarePublished 13 Jun 2026

Lapsus$ ransomware group is claiming Github as a victim (breach not confirmed yet)

Source Reddit Cybersecurity

Discussion

The Lapsus$ ransomware group is claiming to have compromised GitHub, although the breach has not been independently confirmed. Lapsus$ is known for previous high-profile attacks on companies like Nvidia, Microsoft, Samsung, and Uber. The claim includes alleged infostealer activity and compromised employee and user credentials. No ransom demand has been made, and the group states they may leak data if no buyer is found. The situation remains unverified and under investigation.

r/cybersecurity (opens in a new tab)u/Malwarebeasts0 points0 comments

Lapsus$ ransomware group is claiming Github as a victim, typically this group is not bsing. They previously hacked Nvidia, Microsoft, Samsung, and Uber. source - https://ransomware.live/id/R0lUSFVCIElOVEVSTkFMQGxhcHN1cyQ

Links cited in the discussion

https://ransomware.live/id/R0lUSFVCIElOVEVSTkFMQGxhcHN1cyQ

Impact

If true, the breach could expose sensitive employee and user information, potentially impacting over 2.5 million users and nearly 300 employees. The compromise of third-party employee credentials and external attack surface details could increase risk to GitHub and its ecosystem. However, since the breach is unconfirmed and no ransom demand or data leak has occurred, the actual impact remains uncertain.

Defensive guidance

No official confirmation or remediation guidance is available from GitHub at this time. Organizations and users should monitor official GitHub communications for updates. Given the unconfirmed status, no specific mitigation actions are recommended beyond vigilance. Patch status is not applicable as this is an alleged breach claim without confirmed vulnerability or exploit details.

Summary

Lapsus$, a ransomware group with a history of targeting major technology companies, is publicly claiming to have breached GitHub. The claim includes detection of infostealer malware activity and compromise of a large number of employee and user credentials. However, the breach has not been confirmed by GitHub or other authoritative sources. No ransom demand has been issued, and the group has indicated a willingness to leak data if no buyer emerges. The information is sourced from a Reddit cybersecurity post linking to ransomware.live, which aggregates publicly visible ransomware operator claims and related data.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 13 Jun 2026, 16:39 UTC

Technical details

References

Community reviews

Related threats