GitHub hacked: what happened and what to check

Yes, GitHub was hacked in May. An attacker got into the firm's own code stores through an employee's device. GitHub said it found no sign that customers' own code stores were hit. If you use GitHub, check your security log, active sessions and tokens.

GitHub calls a code store a repository, or repo. The May case was about GitHub's internal repos. The later case was about people's accounts and tokens. You can check your own account with tools GitHub provides.

What happened inside GitHub

On May 18, GitHub found that an employee's device had been hacked. The way in was a poisoned VS Code add-on made by a third party. GitHub removed the bad version and cut off the device. It said the attacker took files from GitHub's internal repos. The attacker claimed to have about 3,800 repos; GitHub said that count was broadly in line with its early findings.

GitHub said it had no sign of harm to customer data held outside its internal repos. That includes customers' own repos. But some internal repos do hold customer data, such as parts of support chats. So the update does not rule out all customer data in the stolen files. GitHub said its inquiry was still open when it posted the update.

GitHub also changed key secrets during its response. That was a step by GitHub.

What happened to user accounts

Another report, from The Hacker News, covered the GhostAction attack. It said about 1,900 GitHub accounts were taken over, with more than 30,000 repos targeted. It tied access to stolen login details and personal access tokens. This attack took a different path from the employee add-on in May.

Those counts come from the cited researchers. They do not show that GitHub's own systems were hacked a second time. If you own a repo, look for work under your account that you did not do.

What to check now

Open your security log. GitHub says it shows the past 90 days of actions. Look for anything you do not know. Then open your sessions. You can see which devices have signed in and end a session you do not know.

Check your personal access tokens too. GitHub says to delete a token you no longer need. An older kind of token can reach all your own repos and any group repos you can access. Treat an unknown token as a warning sign.

For a safer sign-in, read GitHub's two-step sign-in guide. GitHub favours a code app and a security key as backup over text messages. These are sound account checks, even though the May case did not show that your own login was stolen.

If you run Enterprise Server

GitHub gave Enterprise Server admins one clear task: rotate the server's GPG public keys. Those keys help confirm that an update came from GitHub. GitHub said Enterprise Cloud needs no step for this key change. If you run Enterprise Server, read GitHub's incident update for the full steps.

Sources

GitHub's incident update; The Hacker News on GhostAction; GitHub Docs on security logs, sessions, tokens and two-step sign-in.