GitHub Investigates Potential Breach as Hacker Group Claims Access to Internal Repositories

GitHub announced Tuesday that it is investigating a potential security incident involving unauthorized access to its internal repositories, following claims by a well-known threat actor group.

The group, identified as TeamPCP, has reportedly put GitHub’s source code and internal organizational data up for sale on a cybercrime forum, triggering concern across both developer and cybersecurity circles.

GitHub, which operates under Microsoft, said it has not found any evidence that customer data outside its internal systems has been compromised. This includes enterprise accounts, organizations, and user repositories hosted on the platform.

“At this time, we have no indication that customer data beyond GitHub’s internal repositories has been affected, but we are actively monitoring our systems for any additional suspicious activity,” the company said.

GitHub also noted that it will alert customers through its standard incident response channels if any impact is confirmed.

Reports indicate that TeamPCP—previously associated with a series of supply chain attacks targeting open-source software—has listed the data for sale with a minimum price of $50,000.

The alleged leak is said to include roughly 4,000 repositories, though the accuracy and full extent of the data have not yet been independently verified.

According to screenshots circulating online, the group claimed the sale is not intended as a ransom attempt but rather a direct transaction.

“This is not a ransom. We are not looking to extort GitHub. If a buyer emerges, we will delete the data. If not, it may be released publicly,” the group reportedly stated.

The situation underscores the growing risks facing major technology platforms and the broader open-source ecosystem. If confirmed, unauthorized access to internal repositories could impact software integrity, security practices, and trust within the global developer community.

As GitHub continues its investigation, the incident highlights the increasing sophistication of cyber threats targeting critical development infrastructure.