Congressional Leaders Demand Answers as CISA Struggles to Contain Massive Credential Leak

In a development that has sent shockwaves through the national security establishment, the U.S. Cybersecurity & Infrastructure Security Agency (CISA)—the very entity tasked with safeguarding the nation’s critical digital infrastructure—has been caught in a catastrophic security lapse. A CISA contractor with administrative privileges intentionally published a trove of sensitive agency secrets, including plaintext AWS GovCloud keys and internal configuration files, to a public GitHub repository.

The exposure, which has left the agency scrambling to rotate compromised credentials, has drawn immediate and fierce condemnation from Capitol Hill. Lawmakers are now questioning whether the agency, currently reeling from internal instability, possesses the operational maturity to protect the nation’s secrets if it cannot protect its own.

The Breach: A Public "Scratchpad" of Secrets

The incident came to light on May 18, 2026, following an investigation by KrebsOnSecurity. The report identified a public GitHub profile dubbed "Private-CISA," which served as an open-access repository for agency secrets. Forensic analysis of the repository suggests it was used by a CISA contractor as a personal "working scratchpad" to synchronize files between work and personal environments.

The repository contained dozens of plaintext credentials, including access tokens for internal CISA systems and AWS GovCloud resources. Perhaps most concerning to security experts is the revelation that the contractor intentionally bypassed GitHub’s built-in "secret scanning" protections—a security feature designed to prevent the accidental upload of sensitive credentials. By actively overriding these safeguards, the contractor essentially invited the public to view the agency’s digital "keys to the kingdom."

Evidence indicates the repository was created as early as November 2025, though the most egregious data uploads—containing the highest-sensitivity credentials—occurred as recently as late April 2026.

Chronology of a Security Collapse

• November 2025: The "Private-CISA" GitHub repository is established. It begins to serve as a synchronization mechanism for a CISA contractor’s work files.
• Late April 2026: The repository is populated with highly sensitive plaintext AWS GovCloud tokens and administrative configuration files.
• May 2026: Security firm GitGuardian detects the exposure and alerts CISA to the presence of the sensitive data.
• May 18, 2026: KrebsOnSecurity publicly reports the breach. CISA acknowledges the incident but remains vague regarding the duration of the exposure.
• May 19, 2026: Sen. Maggie Hassan (D-NH) and Rep. Bennie Thompson (D-MS) issue formal inquiries to CISA’s Acting Director, Nick Andersen, demanding accountability.
• May 20, 2026: Dylan Ayrey, founder of Truffle Security, identifies an active, unrevoked RSA private key within the repo that provides full administrative access to CISA’s entire GitHub enterprise organization.
• Post-May 20, 2026: CISA begins a frantic, piecemeal effort to invalidate the exposed keys, though experts suggest many critical credentials remain active.

The "TruffleHog" Discovery: A Wider Aperture

The danger of the leak was compounded by the fact that the credentials remained live for days after the agency was initially notified. Dylan Ayrey, the creator of the open-source credential-discovery tool TruffleHog, discovered that one of the exposed secrets was an RSA private key. This key granted access to a GitHub app owned by the CISA enterprise account, which was installed on the "CISA-IT" organization with sweeping privileges.

"An attacker with this key could read source code from every repository in the CISA-IT organization, including private repos," Ayrey explained. "They could register rogue self-hosted runners to hijack CI/CD pipelines, access repository secrets, and modify admin settings including branch protection rules and webhooks."

This level of access would allow a sophisticated threat actor not only to exfiltrate proprietary code but to inject malicious backdoors into software updates intended for government use. While CISA eventually invalidated this specific RSA key following follow-up inquiries, Ayrey warned that other critical technologies tied to the leaked credentials remained unrotated for several days, leaving a window of opportunity for state-sponsored actors.

Institutional Fragility: A Diminished Security Culture

The timing of this breach is particularly harrowing. As noted by Senator Hassan in her letter to Acting Director Andersen, this failure occurs against the backdrop of a massive, forced downsizing of the agency. Recent political shifts have led to the departure of more than a third of CISA’s workforce, including a significant portion of its senior leadership team.

The loss of institutional knowledge, combined with a demoralized workforce, has created a "diminished security culture," according to Rep. Bennie Thompson and Rep. Delia Ramirez. In their joint letter, the lawmakers emphasized that the "Private-CISA" repository provided a clear "roadmap" for adversaries such as Russia, China, and Iran to gain persistence on federal networks.

Official Responses and Defensive Posture

CISA’s official stance has been one of damage control. In a brief statement provided to the press, the agency claimed: "There is no indication that any sensitive data was compromised as a result of the incident." They further noted that they are "actively responding and coordinating with the appropriate parties and vendors to ensure any identified leaked credentials are rotated."

However, security researchers remain skeptical. Because GitHub publishes a public "firehose" of all commit activity, it is highly probable that automated scrapers—operated by both independent cybercriminals and state-aligned advanced persistent threats (APTs)—indexed these credentials the moment they were uploaded.

"We monitor that firehose for keys, and we have tools to try to figure out whose they are," said Ayrey. "We have evidence attackers monitor that firehose as well. Anyone monitoring GitHub events could be sitting on this information."

Implications: The "Human Problem" in Cybersecurity

The breach highlights a fundamental tension in modern enterprise security: the conflict between developer convenience and organizational security policy. James Wilson of the Risky Business podcast noted that while organizations can implement top-down controls to prevent the disabling of secret-scanning tools, they often struggle to enforce policies on devices outside their direct oversight.

Adam Boileau, a co-host of the podcast, argued that this is ultimately a "human problem." Even if a firm mandates strict controls on corporate-issued hardware, it is difficult to prevent an employee or contractor from opening a personal GitHub account on a separate device to synchronize work files.

"I don’t know what technical controls you could put in place," Boileau noted, "given that this is being done presumably outside of anything CISA managed or even had visibility on."

Conclusion: A Wake-Up Call for Federal Oversight

The "Private-CISA" scandal serves as a grim reminder that even the agencies tasked with defending the nation are not immune to the vulnerabilities of human error and poor operational security. As Congress prepares for formal hearings on the matter, the focus will likely shift from the specific technical failure to the broader question of whether CISA’s current structure and staffing levels are sufficient to maintain the security of federal networks in an era of constant, high-stakes cyber warfare.

For now, the agency remains in a state of high alert, scrambling to rotate keys and assess the extent of the exposure. The damage, however, may already be done; in the world of cybersecurity, a secret once leaked is a secret no longer, and the "Private-CISA" breach may provide a blueprint for adversaries to exploit the very infrastructure that is meant to protect the American public.