GitHub, the world's largest hosting service for IT projects, has fallen victim to a major cyberattack. Hackers from the TeamPCP group managed to breach the service's internal systems and steal data from 3,800 private company repositories. GitHub's press office has officially acknowledged the scale of the problem but was quick to assure that the "fire" was quickly extinguished.
According to the service's administration, the infected employee device was immediately isolated, and all compromised digital keys and passwords were urgently replaced the same night. GitHub specifically stressed that ordinary users and third-party developers have nothing to worry about—only the service's internal projects were affected. Nevertheless, hackers are already selling the stolen archive on the black market, with prices starting at $50,000.
The most striking aspect of this story is the simplicity with which the attackers bypassed the tech giant's defenses. One of GitHub's lead engineers simply downloaded a malicious extension for the popular code editor Visual Studio Code (VS Code).
As explained by experts from the Aikido Security team, such plugins often have excessive permissions. They can stealthily steal any tokens, passwords, and configuration files directly from the developer's computer, making them an ideal tool for hackers.
The IT community immediately reacted with irony, as the situation resembles a perfect vicious circle: a Microsoft developer within the Microsoft system downloaded a malicious program from Microsoft's official marketplace and ultimately compromised the subsidiary service GitHub, also owned by Microsoft. On Reddit, users are joking that after such news, they want to quit IT, replace their laptop with a shovel, and become a gardener.
For TeamPCP, this is far from their first major success in 2026—just in March, the same hackers derailed the digital security of the entire European Commission. According to reports from the European Cybersecurity Agency (CERT-EU), the group acted using a similar scheme, secretly replacing code in a vulnerability scanner used by European officials. That breach turned into a real disaster for Europe: a massive 340 GB data leak, including internal emails, employee logins and passwords, dealt a severe blow to thirty key EU agencies.
Source: podrobno.uz