Home / Incidents / Data breach
Stolen GitHub accounts push CI secret-stealer to 61,764 repositories
From 10 November attackers used 4,837 compromised GitHub accounts to open pull requests carrying a payload that exfiltrates GitHub Actions secrets and cloud and AI-provider credentials; at least 1,835 repositories ran it.
- Organisation
- GitHub users (compromised accounts)
- Disclosed
- 10 November 2026
- Affected
- Not stated
- Data
- CI/CD secrets, cloud and AI API credentials
- Attacker
- Unknown
- Severity
- major
- Region
- Global
- Source
- Aikido Security ↗
Cite this
Nuffield Consulting, “Stolen GitHub accounts push CI secret-stealer to 61,764 repositories”, The Daily Tech Wire outage & breach log, 10 Nov 2026. https://techwire.nuffieldconsulting.com/incidents/2026-11-10-github-ci-secret-stealer-breach/ (retrieved 15 Nov 2026).
This entry summarises public reporting. Please also cite the original source: Aikido Security, https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories.
Related incidents
- 11 Nov 2026Baltic SMS provider left 125M messages exposedCSCTelecom · breach · Unknown · 125M records
- 9 Nov 2026Nitori warns 37.62m customer records may have leakedNitori · breach · Unknown · 37.6M records
- 9 Nov 2026Frontline Education breach total rises to over 3 millionFrontline Education · breach · Unknown · 3.1M records
- 7 Nov 2026Crédit Mutuel Arkéa hit via a service providerCrédit Mutuel Arkéa · breach · Unknown
- 6 Nov 2026Chainalysis says credentials and live tokens for all customers were exposedChainalysis · breach · Unknown