GITHUB INC
bd_94612baa53b075a4 · schema v1 · pii pii-v1
Full breach record for GITHUB INC →Press / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage and machine-translated to English — verify against the source.
Summary
machine-translatedGitHub, 3,800 internal repositories stolen incident investigation launched (GITHUB, VS Code, malicious extension, cyberattack). GitHub: On May 20, GitHub published the results of its investigation into an intrusion into its internal repositories, resulting from an attack conducted using a malicious Visual Studio Code (VS Code) extension. This attack targeted an employee's devices the day before, and GitHub took measures to remove the malicious version of the extension and isolate the affected terminals. The investigation revealed that approximately 3,800 repositories had been compromised, matching the scale claimed by the attacker, TeamPCP. To mitigate security risks, GitHub rotated critical security keys starting on May 19 and plans to continue analyzing system logs and monitoring in the future.
P pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
May 19, 2026
Press report
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Attack → press
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
If an SEC 8-K, state-AG notice or victim statement lands, DisclosureLens merges it into an incident and links it here.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.