GitHub Detects Unauthorized Access via Malicious VS Code Extension

GitHub detected unauthorized access to its internal systems on May 19, 2026. The breach originated from a malicious VS Code extension installed on an employee device. GitHub says it contained the compromise and removed the malicious extension version.

Breach contained on May 19

The incident may have led to exposure of GitHub's internal repositories. Customer information stored outside those internal repositories is not believed to be affected, according to GitHub. The company is continuing its investigation and plans to publish a detailed report.

GitHub stated that it is investigating unauthorized access to its internal repositories. The company currently has no evidence of impact to customer data stored in enterprises, organizations, or repositories. It is closely monitoring the situation.

It remains unclear whether attackers exfiltrated any data from the internal repositories. GitHub has not confirmed data theft but says it is a possibility. The company has not disclosed the full scope of the incident or a timeline for its final report.