CISA Contractor Leaks AWS GovCloud Keys on Public GitHub
A Nightwing contractor for CISA maintained a public "Private-CISA" GitHub repository exposing administrative AWS GovCloud credentials, dozens of plaintext passwords for internal CISA systems, tokens, and deployment details. The repo, used as a personal scratchpad, was discovered by researchers and taken offline. No compromise has been confirmed, but keys remained valid for hours after notification.
- credentials
- aws-keys
- passwords
- tokens
- internal-system-access
A Nightwing contractor supporting the Cybersecurity and Infrastructure Security Agency inadvertently exposed administrative AWS GovCloud credentials, dozens of plaintext passwords for internal CISA systems, authentication tokens, and deployment details in a public GitHub repository named “Private-CISA.”
Public reporting indicates the repository functioned as the contractor’s personal scratchpad rather than an official project asset. Researchers discovered the exposed material on May 18, 2026, after which the repository was taken offline. Available reporting describes that the AWS keys remained valid for several hours even after notification to the responsible parties. No evidence of actual compromise has been confirmed, yet the presence of live administrative credentials for a U.S. government cloud environment classified the incident as high severity. Industry research from sources such as DoxxScan™ continuous monitoring indicates that credential leaks of this nature frequently surface in underground markets within days of exposure.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary DoxxScan™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15B+ leaked records (including this breach) in 15 seconds — then show you the $14.99 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
