US cyber agency CISA exposed reams of passwords and cloud keys to the open web

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) narrowly avoided a significant security incident, thanks to a diligent researcher who uncovered publicly accessible credentials that could potentially compromise government cloud services and internal systems. This revelation came to light through independent cybersecurity journalist Brian Krebs, who reported on the findings of GitGuardian's Guillaume Valadon. Valadon discovered a trove of exposed plaintext credentials in spreadsheets that were inadvertently made public on a GitHub repository by an employee of a CISA contractor. The sensitive information included access tokens, cloud keys, and files critical to the operations of CISA and its parent agency, the Department of Homeland Security. After validating some of the credentials, Valadon attempted to alert the contractor responsible for the GitHub repository, but received no response, prompting him to reach out to Krebs. This incident is particularly troubling for CISA, an agency tasked with enhancing cybersecurity across the civilian federal network and promoting best practices, including the secure management of passwords. The agency's failure to prevent such a lapse raises questions about its operational security, especially since it's unclear whether anyone else accessed the exposed credentials. When approached for comments, a spokesperson for CISA did not provide immediate feedback regarding potential breaches resulting from the incident or whether the compromised credentials had been revoked. Although the breach originated from a contractor's oversight, CISA holds the ultimate responsibility for ensuring the security of its networks and systems. Furthermore, CISA has been operating without a permanent director since January 20, 2025, following the resignation of Jen Easterly. The agency has also experienced a substantial reduction in workforce due to budget cuts and other staffing changes since the beginning of the Trump administration.