Lawmakers Demand Answers as CISA Tries to Contain Data Leak

Lawmakers from both chambers of Congress are seeking clarification from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) following a report from KrebsOnSecurity that revealed a contractor's deliberate publication of AWS GovCloud keys and a substantial amount of sensitive agency information on a public GitHub account. This investigation is unfolding as CISA continues to grapple with the ramifications of the breach and is in the process of retracting the compromised credentials.

On May 18, KrebsOnSecurity disclosed that a CISA contractor with administrative access to the agency’s code development environment established a public GitHub profile under the name "Private-CISA." This profile contained plaintext credentials for numerous internal CISA systems. Security analysts assessing the compromised data noted that the commit logs for the repository indicated the contractor disabled GitHub’s inherent safeguards designed to prevent the publication of sensitive credentials in public repositories.

While CISA has recognized the data breach, it has not yet addressed inquiries regarding how long the sensitive data was publicly accessible. However, experts who reviewed the now-inaccessible Private-CISA archive observed that it was first created in November 2025, suggesting a pattern indicative of an individual working with the repository as a personal scratchpad or synchronization tool rather than a meticulously curated project repository.

CISA issued a written statement asserting, "there is no indication that any sensitive data was compromised as a result of the incident." Nonetheless, in a letter dated May 19 addressed to CISA's Acting Director Nick Andersen, Sen. Maggie Hassan (D-NH) emphasized that the leak of credentials raises pressing concerns regarding how such a significant security oversight could happen at the very agency tasked with safeguarding against cyber breaches.

"This reporting raises serious concerns regarding CISA's internal policies and procedures at a time of significant cybersecurity threats against U.S. critical infrastructure," noted Sen. Hassan.

Sen. Hassan pointed out that this incident transpired amidst considerable internal disruption at CISA, which has experienced a reduction of over a third of its workforce and a significant turnover in senior leadership following the Trump administration's incentivized departures through early retirement, buyouts, and resignations across various divisions of the agency.

Rep. Bennie Thompson (D-MS), the ranking member of the House Homeland Security Committee, supported Sen. Hassan's concerns.

"We are troubled that this incident may reflect a compromised security culture and/or an inability for CISA to effectively manage its contract support," Thompson articulated in a letter to the acting CISA leader on May 19, co-signed by Rep. Delia Ramirez (D-Ill), the ranking member of the subcommittee on Cybersecurity and Infrastructure Protection. "It is well-known that adversaries such as China, Russia, and Iran aim to infiltrate and maintain a foothold in federal networks. The files contained in the 'Private-CISA' repository provided critical information, access points, and a roadmap to facilitate such actions."

KrebsOnSecurity has learned that more than a week after CISA was initially alerted about the data leak by the security firm GitGuardian, the agency remains actively engaged in efforts to invalidate and replace various exposed keys and secrets.

On May 20, KrebsOnSecurity received communication from Dylan Ayrey, the creator of TruffleHog, an open-source tool designed to identify private keys and other sensitive information concealed within code hosted on GitHub and other public platforms. Ayrey indicated that CISA had not yet invalidated an RSA private key that was exposed in the Private-CISA repository, which permitted access to a GitHub application owned by the CISA enterprise account and granted full access to all code repositories within the CISA-IT GitHub organization.

"An attacker possessing this key can access source code across every repository in the CISA-IT organization, including private repositories, register unauthorized self-hosted runners to hijack CI/CD pipelines and access repository secrets, and alter repository administrative settings including branch protection rules, webhooks, and deploy keys," Ayrey informed KrebsOnSecurity. CI/CD refers to Continuous Integration and Continuous Delivery, which encompasses practices used to automate software building, testing, and deployment.

KrebsOnSecurity informed CISA of Ayrey's findings on May 20. According to Ayrey, CISA seems to have invalidated the exposed RSA private key shortly after that notification. However, he observed that the agency has yet to rotate other leaked credentials associated with crucial security technologies utilized within its technology portfolio.

In response to inquiries about Ayrey's observations, CISA issued a succinct statement, asserting, "CISA is actively responding and coordinating with the appropriate parties and vendors to ensure any identified leaked credentials are rotated and rendered invalid and will continue to take appropriate steps to protect the security of our systems."

Ayrey also mentioned that his organization, Truffle Security, actively monitors GitHub and several other code platforms for exposed keys, striving to alert affected accounts regarding data breaches. This is feasible on GitHub due to the platform's real-time feed which records every commit and modification to public code repositories. However, he noted that cybercriminal groups also monitor these public feeds and are typically quick to exploit any publicly released API or SSH keys.

In practical terms, it is probable that cybercriminal organizations or foreign adversaries have also taken note of the disclosure of these sensitive CISA secrets, with the most blatant leak occurring in late April 2026, Ayrey stated.

"We monitor that firehose of data for keys, and we have tools to attempt to ascertain their ownership," he explained. "We have evidence that attackers also keep a watchful eye on that firehose. Anyone tracking GitHub events could possess this information."

James Wilson, the enterprise technology editor for the Risky Business security podcast, commented that organizations utilizing GitHub to manage their code projects can implement policies that prevent employees from disabling GitHub's safeguards against publishing secret keys and credentials. However, his co-host Adam Boileau remarked that it remains uncertain whether any technology could completely prevent employees from creating personal GitHub accounts to store sensitive and proprietary information.

"Ultimately, this is an issue that cannot be resolved through technical controls," Boileau concluded. "It is a human problem where a contractor employed to handle this work made the decision to utilize GitHub to synchronize content from a work machine to a personal machine. I'm not sure what technical measures could be enforced considering this action was presumably conducted outside of CISA's management or oversight."