{
  "id": "cscloud-github-credential",
  "url": "https://ohshit.app/incidents/cscloud-github-credential/",
  "title": "Cyber Security Cloud finds suspicious GitHub access after an employee credential leaked",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-12",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Cyber Security Cloud",
    "GitHub",
    "credential exposure"
  ],
  "ecosystems": [],
  "summary": "Cyber Security Cloud revoked a leaked GitHub credential after finding suspicious activity in its development area. Customer contact and service communications data may have been accessed. The company reports normal service operation.",
  "splash": "Customer and service-related records stored in the company’s GitHub development area and reachable with the leaked credential.",
  "wipe": "Verify notices with Cyber Security Cloud and scope data or credentials reachable from affected repositories.",
  "in_the_wild": "disputed",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify scope with the vendor",
      "hint": "Use the contact in the vendor notice, csc-customer@cscloud.co.jp, to confirm whether your organization’s records were involved and which fields may have been accessed. Route unexpected credential requests to your security team and verify any notification through an established contact."
    },
    {
      "title": "Review potentially accessible data and credentials",
      "hint": "If the vendor identifies your organization, check whether any integration credentials or sensitive communication data were in the affected repositories. Preserve audit evidence, revoke or rotate verified exposed credentials and review associated access from a trusted environment."
    },
    {
      "title": "Coordinate follow-up and notifications",
      "hint": "For customer-controlled data that the vendor processed, ask for confirmed scope, access dates and containment evidence. Coordinate any required notices with the vendor and preserve confirmed versus possible exposure in the incident record."
    }
  ],
  "sources": [
    {
      "name": "Cyber Security Cloud first incident notice",
      "url": "https://www.cscloud.co.jp/news/info/20261112-2/",
      "says": "Describes the credential leak, suspicious access, potentially affected data, containment and customer notification process.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "One leaked credential and suspicious access are confirmed. Data acquisition is unverified.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 5, 2026",
      "title": "Company confirms earlier suspicious GitHub activity",
      "body": "An outside party had reported that one work credential leaked. The company found access it believes involved that credential."
    },
    {
      "date": "Nov 12, 04:00 UTC",
      "title": "Company discloses possible development data exposure",
      "body": "The company describes credential revocation, rotation and isolation. It is investigating affected records and the exposure route."
    }
  ],
  "body_markdown": "Cyber Security Cloud says an external tip identified one leaked employee credential. On November 5, a review of available GitHub logs found earlier suspicious access the company believes involved a third party using it. The logs cannot cover the credential’s entire period of validity. The company is investigating the exposure route and has not published a count of affected records or people. It says company names, names and email addresses of some customers, and communications information tied to service use may have been viewed or obtained.\n\nThe provider revoked the credential, checked and changed other service credentials stored in GitHub, reviewed related access rights, isolated relevant development devices and suspended related accounts. It reports no confirmed unauthorized activity in its services, secondary harm or impact to service delivery or security functions. It reported the matter to Japanese authorities, including the Personal Information Protection Commission. It plans to contact customers as it confirms the scope and coordinate notices with the customers whose data it processes."
}