GitHub said that leaked passwords were used to access its accounts

On Tuesday evening Github became aware of unauthorized attempts to access a large number of its accounts, in response the company has reset their passwords.

GitHub announced it has reset the passwords of a number of accounts after the company noticed unauthorized access. The hackers used credentials leaked online after the numerous data breaches suffered by other companies.

Users’ bad habits in password management are a key component for the success of this kind of attacks. Users often chose weak passwords and share the same credentials across multiple websites.

GitHub confirmed to have detected a large number of attempts to access users’ accounts. The unauthorized accesses were detected on Tuesday evening as explained in the official announcement. GitHub highlighted that its systems have not been hacked by attackers.

“On Tuesday evening PST, we became aware of unauthorized attempts to access a large number of GitHub.com accounts. This appears to be the result of an attacker using lists of email addresses and passwords from other online services that have been compromised in the past, and trying them on GitHub accounts. We immediately began investigating, and found that the attacker had been able to log in to a number of GitHub accounts. GitHub has not been hacked or compromised.” states the security update published by GitHub.

“For affected accounts, usernames and passwords are involved. Additionally, for some accounts, other personal information including listings of accessible repositories and organizations may have been exposed,”

GitHub has already reset the passwords of the affected accounts, at the same time it is suggesting users to adopt a proper security posture to avoid being victims of the hackers.

“We encourage all users to practice good password hygiene and enable two-factor authentication to protect your account,” states GitHub. “These attacks often evolve, and we’re continuing to investigate and monitor for new attack vectors.”

Recently a number of web services suffered a data breach, the criminal underground was flooded with hundred thousand million records resulting from the security breaches of LinkedIn , Myspace, VerticalScope, Tumblr, and VK .

Other IT giants like Twitter, Reddit, TeamViewer, Netflix, and Facebook reset passwords of their users.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – GitHub , hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.