enforcement/trade-press/
Contractor exposed CISA credentials on public GitHub repo
House Democrats want answers on how Nightwing left CISA's internal access data publicly readable, and whether staff cuts set the conditions.
Editorial brief
Researcher Brian Krebs reported Monday that a GitHub repository linked to government contractor Nightwing exposed CISA and DHS authentication credentials, AWS GovCloud access data, and internal build-and-deploy documentation, stored in a repo labeled "Private CISA" that was later removed. Reps. Bennie Thompson and Delia Ramirez, the top Democrats on the House Homeland Security Committee and its cyber subcommittee, sent CISA acting Director Nick Andersen a letter Tuesday demanding a briefing on how the exposure occurred, what was accessed, and what corrective action is planned for the contractor personnel involved. Sen. Maggie Hassan sent a separate letter the same day. Nextgov has not independently verified the repository's contents; Nightwing referred inquiries to CISA, which declined to comment publicly.
The exposed repository reportedly included enough information for a sophisticated actor to map how CISA builds, tests, and deploys its internal software. Security researchers cited in Krebs's reporting called it "one of the most egregious government data leaks in recent history." Thompson and Ramirez, in their letter, said they agreed with that characterization.
The Democratic lawmakers also connected the incident to CISA's workforce reductions over the past year, arguing that a reduced staff "coupled with the administration's indifference to security, created the conditions that allowed such a significant security lapse to occur." That causal claim is plausible but unproven at this stage; the actual mechanism (contractor personnel with access to a repository that should not have been public) is a configuration control problem. Whether staffing levels at CISA degraded the oversight that would have caught it is exactly the kind of question a briefing could clarify.
Nightwing, the contractor at the center of the incident, referred all questions to CISA. CISA said it does not comment on congressional correspondence but responds to members directly. That leaves the public record thin on specifics: what credentials were rotated, whether any unauthorized access occurred before removal, and what the timeline between publication and discovery actually was.
A third letter, from Sen. Hassan, was reported by Axios on Tuesday, indicating the briefing request is bicameral. Thompson and Ramirez asked for the briefing "as soon as possible," covering the cause, consequences, remediation, and contractor accountability. Until CISA responds, the operative facts are what Krebs reported and what the lawmakers confirmed they believe: sensitive internal access data sat in a public GitHub repository long enough for independent researchers to find and catalog it.
Published ·Updated ·Deep Fathom