Reported by 1 outlet
CISA Contractor Leaks AWS GovCloud Keys — Worst Government Data Leak in Recent History
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.70 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
CISA Contractor Leaks AWS GovCloud Keys — Worst Government Data Leak in Recent History
krebsonsecurity.com · 148d ago · May 19th, 2026
A Nightwing contractor working for CISA maintained a public GitHub repository named "Private-CISA" since November 2025 that exposed highly privileged AWS GovCloud administrative credentials, plaintext passwords for dozens of internal CISA systems, and access credentials for the agency's internal software artifact repository. The 844 MB repository included CI/CD build logs, Kubernetes manifests, Terraform infrastructure code, SAML certificates, and detailed documentation of CISA's internal deployment workflows. GitGuardian researcher Guillaume Valadon called it "the worst leak I've witnessed in my career," noting the contractor had deliberately disabled GitHub's built-in secret scanning feature. Security researcher Philippe Caturegli (Seralys) validated the credentials granted high-privilege access to three AWS GovCloud accounts. The artifact repository access is considered the most dangerous vector — a compromised build pipeline could allow attackers to inject backdoors into every CISA software deployment. The repository was taken down on May 15 after KrebsOnSecurity and Seralys notified CISA directly, but the AWS keys remained valid for an additional 48 hours. CISA's response: "Currently, there is no indication that any sensitive data was compromised." The agency has lost nearly one-third of its workforce since the start of the second Trump administration.