184 Days That No One Noticed: What CISA Tore Open Wasn't Just a Crack, But the Entire Trust System

If there is one thing in May 2026 that kept global cybersecurity professionals collectively awake at night, it must be the CISA password leak incident. This was not an ordinary data breach; it was the U.S. highest cybersecurity authority openly displaying all its secrets on GitHub—administrator passwords, root user keys, internal system credentials—for a full six months without any alarms being triggered. It wasn't until an external security firm discovered the problem for them that the entire incident was dragged into the spotlight. Ironically, preventing such incidents from happening to others is precisely CISA's core responsibility.

The technical details of the incident were not complicated, but each link points to the same conclusion: human error outweighed natural disasters. An employee of the contractor Nightwing created a GitHub repository named "Private-CISA" in November 2025 and publicly uploaded 844MB of sensitive data—including K8s configurations, Terraform code, and CI/CD logs. Even more absurdly, this person manually disabled GitHub's key scanning function, effectively removing the last security valve. From November 2025 to May 2026, this ticking time bomb quietly lay on the world's largest code hosting platform, accessible to any attacker with basic searching skills. GitGuardian discovered it on May 14 and notified CISA; four days later, Krebs reported it publicly, prompting the House and Senate to send questioning letters. But during those 184 days, who exactly accessed these credentials remains unknown.

What truly sends chills down the spine is how closely this incident coincided with another attack during the same period. This week, hacking group TeamPCP was exposed for using malicious VS Code extensions to infiltrate GitHub, stealing over 3,800 internal code repositories, currently being sold in bulk on the dark web for more than $50,000. Even more dangerous, the group poisoned over 300 software packages in the npm ecosystem within just 22 minutes, several of which were popular libraries with millions of weekly downloads, embedding a worm program called Mini Shai-Hulud. This means that even if the CISA incident was an isolated operational mistake, the entire developer ecosystem is undergoing a coordinated systemic attack. The attackers' logic is clear: rather than struggling to breach a well-protected target, it is more efficient to poison its supply chain and let everyone using these tools do the intrusion for you.

CISA has currently reset all credentials and launched an emergency investigation, but technical fixes are only the simplest step. The deeper issue is that CISA itself is experiencing severe talent loss—over 35% of employees have left, and security audits are nearly paralyzed due to understaffing. An agency that cannot even protect itself has been tasked with protecting the nation's critical infrastructure; this structural contradiction is the greatest security risk. When senators demanded in a letter that the CISA director explain 'why the highest security agency's standards are lower than those of a startup,' this question essentially has no answer, because the answer itself is the problem.

The impact of this incident goes far beyond the United States. Tens of thousands of companies and developers around the world rely on the npm ecosystem and GitHub for daily development; once the supply chain is continuously contaminated, the foundation of the entire digital economy is damaged. CISA's collapse is not the end, but a signal: in cybersecurity, the deadliest vulnerabilities have never been outside the firewall, but in the internal cracks caused by institutional inefficiency and personnel loss. When the guardians themselves become the largest attack surface, everyone needs to reassess what they are actually trusting.