GitHub Reports Breach of 3,800 Internal Repositories

GitHub confirmed that attackers stole data from around 3,800 internal code repositories. The company said it detected the compromise through an employee device that had been infected by a poisoned Visual Studio Code extension. GitHub stated it has no evidence that customer information stored outside its internal repositories was affected. The company added that its investigation remains ongoing.

The company did not name the compromised extension.

GitHub also did not respond to questions about whether it had received any communication from the attackers, including possible ransom demands. The Record and Bleeping Computer reported that a hacking group called TeamPCP claimed responsibility for the breach and is selling the stolen data on a cybercrime forum.

TeamPCP previously claimed credit for a breach at the European Commission that resulted in the theft of more than 90 gigabytes of data. The group had stolen cloud credentials during an earlier attack on Trivy, a vulnerability scanning tool. OpenAI was also targeted in a separate incident involving malware pushed through Tanstack, a platform used by web developers.