CISA Contractor Exposes AWS GovCloud Keys and Internal Passwords in Public GitHub Repo
What Happened — A CISA contractor inadvertently published a public GitHub repository containing 844 MB of internal data, including administrative AWS GovCloud keys and plaintext usernames/passwords for dozens of CISA systems. The repository remained exposed for almost six months before GitGuardian alerted CISA on May 15 2026.
Why It Matters for Compliance & Audit Readiness
- The incident illustrates a classic failure of access‑control and secret‑management processes that SOC 2 Trust Services Criteria (CC6.1, CC6.2) are designed to address.
- Continuous evidence of key‑rotation, secret‑scanning, and incident‑response workflows is essential to demonstrate due diligence during a SOC 2 audit.
- Verisq’s SOC2 Access Controls capability provides automated monitoring of credential exposure and audit‑ready evidence of remediation actions.
Who Is Affected — Federal government agencies, contractors handling federal data, and any organization that integrates with AWS GovCloud or similar high‑value cloud environments.
Recommended Actions
- Map secret‑management and key‑rotation procedures to SOC 2 CC6 controls; capture rotation logs as audit evidence.
- Deploy continuous secret‑scanning across all code repositories and enforce automated revocation of exposed keys.
- Formalize separate reporting channels for external disclosures versus internal incidents to meet SOC 2 CC7 incident‑response requirements. Source: Krebs on Security
Technical Notes
- Attack vector: public GitHub repository (misconfiguration / credential leak).
- Exposed data: AWS GovCloud access keys, CSV of usernames/passwords, other internal configuration files.
- No known CVEs; the root cause is inadequate secret‑management and delayed key rotation. Source: Krebs on Security