Approximately 3,800 internal code repositories were compromised in a recent breach at GitHub, a platform under Microsoft’s ownership. The company has initiated an investigation into the incident, which it attributes to a compromised employee device linked to a malicious Visual Studio Code extension.
GitHub has assured users that there is currently “no evidence” indicating that customer information stored outside of its internal repositories was affected. The ongoing investigation aims to clarify the extent of the breach, while the specific extension involved has not been disclosed.
The hacking group TeamPCP has claimed responsibility for this incident and is reportedly offering the stolen data on a cybercrime forum. Previously, TeamPCP was involved in a significant breach of the European Commission, where over 90 gigabytes of sensitive data were stolen. This incident highlights a rising trend where hackers target popular open-source projects to maximize their reach and impact.
In a related context, a recent attack also targeted OpenAI, where hackers infiltrated a development platform to deploy malware aimed at stealing user credentials.