GitHub confirms it was hacked by TeamPCP

GitHub confirms it was hacked by TeamPCP The code-hosting platform says the incident did not compromise its customers’ personal data. GitHub said on May 20, 2026, that it was investigating an intrusion by the cybercriminal group TeamPCP into several thousand of its internal code repositories. The breach resulted from the compromise of an employee’s computer through a malicious extension. TeamPCP put the stolen repositories up for sale on a cybercriminal forum and threatened to leak them if no buyer came forward before an ultimatum expired. According to GitHub, the breach was “detected and contained”: it was limited to internal repositories and did not involve customers’ personal data. The company added that TeamPCP’s claims, which refer to the theft of around 3,800 repositories, are “broadly consistent” with its own estimate of the incident’s scale. First observed in late 2025, TeamPCP has specialized in supply-chain attacks. The group has notably targeted development tools such as TanStack, Trivy and LiteLLM. Its origin remains unknown, although several elements suggest connections to the Middle East.

GitHub said on May 20, 2026, that it was investigating an intrusion by the cybercriminal group TeamPCP into several thousand of its internal code repositories. The breach resulted from the compromise of an employee’s computer through a malicious extension. TeamPCP put the stolen repositories up for sale on a cybercriminal forum and threatened to leak them if no buyer came forward before an ultimatum expired.

According to GitHub, the breach was “detected and contained”: it was limited to internal repositories and did not involve customers’ personal data. The company added that TeamPCP’s claims, which refer to the theft of around 3,800 repositories, are “broadly consistent” with its own estimate of the incident’s scale.

First observed in late 2025, TeamPCP has specialized in supply-chain attacks. The group has notably targeted development tools such as TanStack, Trivy and LiteLLM. Its origin remains unknown, although several elements suggest connections to the Middle East.