Hackers Are Using Old GitHub Accounts to Research Companies. What Parents Should Know

Security researchers at Datadog Security Labs have discovered that attackers are using old, inactive GitHub accounts to systematically collect information about companies and their employees. GitHub is a platform where programmers store and share code.

The attackers are using accounts that have been sitting unused for years, or they have taken over accounts using stolen login credentials. They are using automated tools to scan through company information and figure out who works where and what projects they are working on.

This threat primarily affects businesses and their employees rather than everyday families. If someone in your household works at a company that uses GitHub for their software projects, their work account and professional information might be part of what these attackers are mapping out.

The attackers are not directly stealing money or personal family data. They are gathering intelligence that could be used in future targeted attacks against companies. For most families, there is no immediate action required.

1. Log into any old GitHub accounts you may have created and either delete them if you no longer use them, or update the password to something strong and unique.
2. Enable two-factor authentication on your GitHub account if you still use it.
3. If you work for a company that uses GitHub, inform your IT department if you notice any unusual activity on your work account. This situation highlights an important digital safety principle: old, forgotten accounts can become security risks. Make it a habit to review what online accounts you have every six months. Close accounts you no longer use. For accounts you want to keep, ensure they have strong, unique passwords and two-factor authentication turned on. This prevents attackers from taking over your dormant accounts and using them for malicious purposes.