Yes, even coders make the mistake of reusing passwords

GitHub has issued a security advisory:

On Tuesday evening PST, we became aware of unauthorized attempts to access a large number of accounts. This appears to be the result of an attacker using lists of email addresses and passwords from other online services that have been compromised in the past, and trying them on GitHub accounts. We immediately began investigating, and found that the attacker had been able to log in to a number of GitHub accounts.

The end result is that for some accounts “other personal information including listings of accessible repositories and organizations may have been exposed.” Yuck.

GitHub has reset passwords for affected accounts and is reaching out to affected users.

Sign up to our free newsletter.
Security news, advice, and tips.

It’s important to underline that GitHub itself didn’t suffer a breach. The passwords were probably gleaned from mega-breaches on other sites such as LinkedIn and Tumblr.

Repeat after me:

Thou shalt not make to thyself the same password on different websites, and thou shalt enable two-factor authentication pronto.

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.