# GitHub internal repos breached

_GitHub confirms internal repositories were accessed via a compromised VS Code extension, with no evidence of customer data being affected._

**Updated:** 2026-08-22
**Published:** 2026-05-20
**Source:** https://www.startuphub.ai/ai-news/technology/2026/github-internal-repos-breached

---

[GitHub](/ai-news/technology/2026/github-copilot-adjusts-pricing) is investigating an unauthorized access incident that compromised its internal repositories. The breach, detected on May 18th, originated from a poisoned VS Code extension published by a third party.

VS Code Extension CompromisedDriverthird-party VS Code extension published with malicious codeFrom the articleThe breach, detected on May 18th, originated from a poisoned VS Code extension published by a third party.led toGitHub Internal Repos AccessedEffectFrom the article 2 mentionsGitHub is investigating an unauthorized access incident that compromised its internal repositories.Malicious Version RemovedOutcomeFrom the articleAccording to a blog post from the company, the malicious extension version was removed, and the affected employee device was isolated immediately.Employee Device IsolatedOutcomeaffected employee device was isolated to prevent further spreadFrom the articleAccording to a blog post from the company, the malicious extension version was removed, and the affected employee device was isolated immediately.Internal Repos ExfiltratedEffectactivity involved exfiltration of GitHub-internal repositories onlyNo Customer Data ImpactOutcomeno evidence of customer data being affected outside internal systemsFrom the article 2 mentionsCrucially, the company states there is no evidence of impact to customer information stored outside of GitHub's internal systems, such as customer enterprises, organizations, and repositories.Customer Support ExcerptsContextFrom the articleHowever, some internal repositories did contain excerpts of customer support interactions.may triggerCustomer Notification PendingEffectcustomers will be notified if any impact is discovered

According to [a blog post](https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/) from the company, the malicious extension version was removed, and the affected employee device was isolated immediately. GitHub's current assessment indicates that the activity involved the exfiltration of GitHub-internal repositories only.

The attacker's claims of compromising around 3,800 repositories align with GitHub's ongoing investigation. Crucially, the company states there is no evidence of impact to customer information stored outside of GitHub's internal systems, such as customer enterprises, organizations, and repositories. However, some internal repositories did contain excerpts of customer support interactions.

GitHub has confirmed that customers will be notified via established channels if any impact is discovered.

## Rapid Response

In response to the incident, GitHub rotated critical secrets on Monday and Tuesday, prioritizing the highest-impact credentials first. The company is continuing to analyze logs, validate secret rotation, and monitor its infrastructure for any follow-on activity.

A fuller report will be published once the investigation is complete.

---

Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.

© StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.