14 DAY TRIAL // GitHub has announced today it started a password reset operation for all users affected by a series of automated login attempts the company noticed this past Tuesday.
The company said it wasn't hacked, but someone appears to have used credentials leaked during recent mega breaches to access GitHub user accounts.
"This appears to be the result of an attacker using lists of email addresses and passwords from other online services that have been compromised in the past, and trying them on GitHub accounts," GitHub's Shawn Davenport explained.
GitHub wasn't hacked, your source code repos are safe
The good news is that GitHub's engineers detected the attack immediately after it happened, on Tuesday evening, Pacific time.
A subsequent investigation revealed that a third-party was testing a large number of usernames and passwords. GitHub informs us the crooks managed to access some accounts.
For all affected accounts, GitHub claimed it started sending password reset notifications. The company is also urging users to take a look at their password's complexity level, and optionally enable two-factor authentication for their accounts.
Private GitHub source code repos can be very valuable
Why would someone try to access GitHub accounts first, and not social media profiles? The answer is that some GitHub users have access to private repos.
These private repos host the source code of enterprise software, which in some cases may be used for crucial infrastructure.
Companies like Netflix and Facebook beat GitHub to the punch by acquiring some of the data leaked during recent mega breaches and starting a preemptive password reset for all exposed users.
Some of the companies that suffered massive data leaks include LinkedIn (117 million credentials), Myspace (360 million credentials), Tumblr (65 million credentials), VK (100 million credentials), Fling.com (40 million credentials), and most recently, iMesh (51 million credentials) and VerticalScope (45 million credentials).
Additionally, over 32.8 million Twitter plaintext credentials were also exposed, but this happened because of malware installed on the users' computers, and not via an intrusion into Twitter's servers.