Summary Points
- Checkmarx’s supply chain attack resulted in a cybercriminal group leaking company data on the dark web, believed to have originated from their GitHub repository.
- The compromised GitHub repository is separate from customer environments, and no customer data is currently confirmed to be involved.
- The attack followed a series of breaches involving tampered GitHub workflows, plugins, and Docker images, attributed to the TeamPCP group and LAPSUS$.
- Checkmarx is investigating the incident, has secured the repository, and will notify affected customers if any customer data is found to be compromised.
Checkmarx Confirms Data Leak from GitHub Repository
Checkmarx announced that it is investigating a security breach involving its GitHub account. The company revealed that a cybercriminal group posted data on the dark web after a recent supply chain attack. This incident appears to be linked to a security breach that occurred on March 23, 2026. The company confirmed that the compromised data came from one of its GitHub repositories. Importantly, they emphasized that this repository is separate from customer systems and does not store any client data. Checkmarx’s team is working diligently to determine exactly what information was posted and to strengthen security measures. As part of their response, they have restricted access to the affected repository and are committed to informing customers if any sensitive information related to them is involved.
Broader Impact and Ongoing Investigation
The breach comes after claims from the LAPSUS$ hacking group, which listed Checkmarx among their victims. According to reports, their leaked data includes source code, employee information, API keys, and database credentials. In recent weeks, Checkmarx suffered multiple attacks following a supply chain compromise. These attacks affected their tools, including GitHub Actions workflows and plugins, which were tampered with to steal developer secrets. A group known for financial motives claimed responsibility for these incidents. The breach has also compromised some of their Docker images and a package used with the popular code editor, leading to further security concerns. Checkmarx continues to investigate the full scope of the damage, aiming to protect its systems and users from future threats.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
DataProtection-V1
