GitHub Source Code Breach – TeamPCP Claims Access to Internal Source Code

HomeCyber Security GitHub Source Code Breach – TeamPCP Claims Access to Internal Source Code By Guru Baran May 20, 2026 A notorious threat actor operating under the alias TeamPCP claims to have breached GitHub’s internal systems, allegedly exfiltrating proprietary organization data and source code. The attackers are offering the stolen dataset for sale on underground cybercrime forums, demanding offers exceeding $50,000. According to the threat actor’s post, the compromised data encompasses approximately 4,000 private repositories tied directly to GitHub’s main platform. Threat Actor Claim (Source: Darkweb Informer) To validate their claims, TeamPCP has published a public file list and screenshots displaying numerous repository archive names. The group has stated its willingness to provide data samples to serious buyers to prove authenticity. Following the circulation of these claims, GitHub publicly confirmed an ongoing investigation into the matter. In a statement released via X (formerly Twitter), the company acknowledged the unauthorized access but sought to reassure users regarding the safety of customer data. WE ARE INVESTIGATING UNAUTHORIZED ACCESS TO GITHUB’S INTERNAL REPOSITORIES. WHILE WE CURRENTLY HAVE NO EVIDENCE OF IMPACT TO CUSTOMER INFORMATION STORED OUTSIDE OF GITHUB’S INTERNAL REPOSITORIES (SUCH AS OUR CUSTOMERS’ ENTERPRISES, ORGANIZATIONS, AND REPOSITORIES), WE ARE CLOSELY… — GitHub (@github) May 19, 2026 “We are investigating unauthorized access to GitHub’s internal repositories,” GitHub stated. “While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity”. TeamPCP, formally tracked by the Google Threat Intelligence Group as UNC6780, is a highly capable, financially motivated threat group known for orchestrating severe cross-ecosystem supply chain attacks. Earlier in 2026, the group successfully compromised several major security and development tools: Trivy Vulnerability Scanner: Exploited via CVE-2026-33634, leading to the breach of over 1,000 organizations, including Cisco. Checkmarx and LiteLLM: Targeted in a high-velocity campaign aimed at credential harvesting within CI/CD pipelines. Shai-Hulud Malware: The group recently leaked the source code for their own Shai-Hulud malware directly onto GitHub using compromised accounts. TeamPCPs’ operational pattern, leveraging stolen CI/CD credentials and privileged access tokens to pivot deeper into target infrastructure, makes the current claim technically credible. The investigation is ongoing. GitHub has not disclosed how the alleged access was obtained, nor has it confirmed or denied the validity of the 4,000-repository claim. IF ANY IMPACT IS DISCOVERED, WE WILL NOTIFY CUSTOMERS VIA ESTABLISHED INCIDENT RESPONSE AND NOTIFICATION CHANNELS. — GitHub (@github) May 19, 2026 Further updates are expected as the inquiry progresses. Follow us on Google News, LinkedIn, and X to Get More Instant Updates. Tags cyber security news Copy URL Linkedin Twitter ReddIt Telegram Guru Baranhttps://cybersecuritynews.com Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments. Trending News Chinese APT Hackers Exploit Microsoft Exchange to Breach Energy Sector Network TeamPCP Hackers Abuse CI/CD Pipelines to Steal Developer and Cloud Credentials Sandworm Hackers Pivot From Compromised IT Systems Toward Critical OT Assets Microsoft Releases Cumulative Update for Windows 11, Version 25H2 and 24H2 Critical WordPress Plugin Vulnerability Exposes Websites to Authentication Bypass Attacks Latest News Cyber Security News macOS Malware Installs Fake Google Software Update LaunchAgent for Persistence Cyber Security News The Gentlemen Ransomware Attacks Windows, Linux, NAS, BSD, and ESXi Attacks Cyber Security News Kimsuky Hackers Use LNK and JSE Lures to Target Recruiters, Crypto Users, and Defense Officials Press Release Criminal IP Returns to Infosecurity Europe 2026 with Advanced AI-Driven TI & ASM Cyber Security News Malware Campaign Uses JavaScript, PowerShell, and Shellcode to Deliver Crypto Clipper