2026 GitHub — unauthorized access to internal repositories via poisoned VS Code extension (May 20)
Data compromised
GitHub internal repositories (forensic scope pending); no attested github.com user/customer PII volume in initial post
Technical writeup
On May 20, 2026, GitHub posted the first message in a public incident thread stating it is sharing additional details on unauthorized access to GitHub’s internal repositories. The company said it detected and contained a compromise of an employee device involving a poisoned Visual Studio Code extension, removed the malicious extension version, isolated the endpoint, and began incident response immediately. GitHub did not publish a customer record count or confirm end-user repository content exposure in the opening post; BreachHistory classifies the row as a corporate internal-source incident and developer-supply-chain spillover rather than a github.com user credential database breach. Separate May 2026 OSINT posts (e.g., TeamPCP marketing of alleged internal source code) preceded GitHub’s confirmation but were not independently verified in the company’s initial disclosure.
Root cause
Poisoned Visual Studio Code extension on an employee device enabling unauthorized access to GitHub internal repositories