BreachPublished 22 May 2026

Lawmakers Demand Answers as CISA Tries to Contain Data Leak

Source Krebs on Security

Description

A CISA contractor intentionally published AWS GovCloud keys and other sensitive agency secrets on a public GitHub repository, leading to a significant data leak. Lawmakers in the U.S. Congress are demanding answers as CISA attempts to contain the breach and invalidate the compromised credentials. The incident involves exposure of critical cloud service credentials and agency secrets, raising concerns about insider threat and credential management. There is no confirmed evidence of exploitation in the wild at this time.

Impact

The exposure of AWS GovCloud keys and agency secrets could allow unauthorized access to sensitive government cloud infrastructure and data if the credentials are not promptly invalidated. This compromises confidentiality and potentially integrity of agency systems. The breach undermines trust in contractor security practices and requires urgent containment to prevent misuse. No known exploitation in the wild has been reported yet.

Defensive guidance

CISA is actively working to contain the breach and invalidate the leaked credentials. Organizations should ensure that exposed credentials are revoked immediately and rotate any affected keys. Review and tighten access controls and credential management policies for contractors. Monitor for any unauthorized activity related to the leaked credentials.

Summary

This incident involves a deliberate insider action by a contractor for the U.S. Cybersecurity & Infrastructure Security Agency (CISA), who publicly exposed AWS GovCloud keys and a large volume of agency secrets on GitHub. The leak has prompted congressional inquiries and ongoing efforts by CISA to contain the breach, including invalidating the leaked credentials. The exposure of cloud service keys poses a risk of unauthorized access to sensitive government cloud resources. No specific technical vulnerability or exploit is described; the issue centers on credential exposure due to insider misconduct.

References

krebsonsecurity.com/2026/05/lawmakers-demand-answers-as-cisa-tries-to-contain-data-leak/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2026, 22:01 UTC

References

Community reviews