GitHub confirms data theft from 3,800 internal repos via malicious VS Code extension

GitHub has confirmed a significant security breach in which attackers exfiltrated data from approximately 3,800 of its internal code repositories. The Microsoft-owned platform stated the incident was detected and contained on May 20, 2026, after an employee downloaded a malicious extension for the Visual Studio Code editor.

According to the company, the compromised extension provided the attackers with access to the employee's device, enabling them to steal data from internal repositories. GitHub said it has removed the malicious software, isolated the affected device, and rotated critical credentials. The company's investigation indicates the breach was limited to its internal systems, with no current evidence that customer data, enterprise accounts, or user-hosted repositories were impacted.

A financially motivated cybercrime group known as TeamPCP has claimed responsibility for the attack. The group has advertised the stolen data, described as proprietary source code and internal organization files, for sale on a cybercrime forum for at least $50,000. GitHub stated the attackers' claim of accessing roughly 3,800 repositories is directionally consistent with its own findings.