The New York Times GitHub Breach

Originally published by Suridata.

Recently, the security landscape has been shaken by several high-profile breaches, and the latest incident involving GitHub tokens has once again highlighted the critical importance of Machine-to-Machine security practices. This blog dives deep into the details of The New York Times GitHub token breach that exposed the entire source code of The New York Times, its implications, and what organizations can do to safeguard their systems.

A Bad Time for The New York Times: Entire Source Code Exposed

Using a stolen GitHub token, attackers exploited access to The New York Times’ GitHub repositories.

This token was overprivileged, granting access to all repositories within The New York Times GitHub organization. It is probable that the token was poorly managed, having a long expiry period, being leaked through accidental public exposure, stored on a compromised employee’s device, or used by an ex-employee to access private GitHub content.

This breach underscores the risks associated with SaaS application tokens, which are often the most vulnerable points and the entry point to the organization’s sensitive data.

What Happened?

The breach occurred in January 2024 when attackers used a stolen GitHub token to access The New York Times’ repositories. The attacker leaked data, which included 270GB and over 5,000 repositories, with fewer than 30 being encrypted. The stolen files contained IT documentation, infrastructure tools, and source code, including the viral Wordle game.

The Impact

The impact of this breach is far-reaching:

• Repository Access: Attackers could access private repositories, leading to data leaks and exposure of proprietary code.
• Data Manipulation: With write access, malicious actors could alter or delete critical code, inject malicious code, or disrupt development processes.

Conclusion

Organizations must remain proactive in securing their development environments, especially when they are easily accessed through tokens. By continuously improving defenses, and embracing automated responses, organizations can better protect their valuable assets from evolving threats.