Bottom line: CISA violated its own recommendations for protecting sensitive information in a data breach.
The US cybersecurity agency CISA left confidential data unprotected on Github for months and must be accused of ignoring its own security guidelines.
The US Cybersecurity and Infrastructure Security Agency (CISA) announced that classified agency data had been publicly accessible on the code hosting platform Github for an extended period. This was discovered after the data had already been exposed for several months.
In addressing the incident, CISA acknowledged that it did not comply with the security guidelines that it itself recommends and mandates to other organizations as a national agency. This particularly concerns the handling and management of sensitive information as well as the implementation of access controls for confidential data.
For CISOs, this case illustrates the importance of a consistent security culture: even in institutions with high security awareness, process gaps can occur. The lesson is that policies must be reviewed regularly and enforced internally as well, regardless of how established an organization is.
Source: www.golem.de · Published 13 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.