La policía investiga la fuga masiva de tokens de acceso a GitHub

South Korean police have begun an investigation into a suspected mass leak of GitHub personal access tokens, following reports that more than 500 accounts may have been compromised. The incident was confirmed by authorities after identifying exposure of sensitive credentials that could provide unauthorized access to private repositories hosted on the Microsoft-owned platform. The breach reportedly occurred through an unspecified method, though details remain unclear. GitHub, which serves as a central hub for software development and collaboration, uses personal access tokens as a form of authentication to secure user access. These tokens, once exposed, can enable attackers to retrieve source code, internal documentation, or other confidential data tied to critical systems. According to the Chosun Ilbo, the number of potentially impacted accounts exceeds 500, raising concerns among both individual users and organizations reliant on the platform. In response, the National Office of Investigation under the National Police Agency issued a detailed security advisory, urging affected parties to take immediate action. The directive recommends reviewing access logs for unusual activity within the last three months and revoking any exposed tokens. Users are also advised to generate new tokens and implement stronger security protocols such as two-factor authentication. Additional precautions include restricting access privileges, avoiding the storage of credentials in source code, and utilizing secret-scanning tools to identify potential vulnerabilities. The police have informed Microsoft, Interpol, and other affected entities of the situation, emphasizing the need for heightened vigilance. They have also called for companies to perform thorough security audits of devices used by developers, highlighting the broader implications of the breach beyond just individual account compromise. “This case involves not only corporate information and communication networks but also development infrastructure,” stated Park Woo-hyun, a senior cyber investigation official with the National Police Agency. He stressed the importance of prompt reporting by companies that suspect their systems may have been breached. GitHub has taken steps to mitigate the risk by revoking the exposed tokens and notifying affected users. However, the company has not yet released specific details regarding how the breach occurred or whether it has identified the responsible party. Security experts warn that even with these measures, the exposure of such credentials poses a serious threat, particularly given the potential for misuse in future cyberattacks. Authorities are currently working to determine the extent of the breach and identify any patterns that might indicate a larger-scale attack. While no ransom demands or direct threats have been made public, the incident underscores the growing risks associated with the improper handling of digital credentials. As investigations continue, officials are urging all users and organizations to remain vigilant and adopt best practices to protect their online presence.