Hackers Are Using Old GitHub Accounts to Spy on Companies. Should You Worry?

Security researchers at Datadog Security Labs have discovered that attackers are using old, inactive GitHub accounts to secretly gather information about companies. These attackers are using automated tools to collect lists of company repositories, user accounts, and organizational structures through GitHub's public interface.

The attackers are using accounts that have been dormant for years, or they are using stolen login credentials to blend in and avoid detection. This threat primarily affects businesses and organizations that use GitHub for their software development work.

If you work at a company that uses GitHub, your company's organizational structure and employee information might be mapped by these attackers. However, this does not directly threaten personal family accounts or home users. The attackers are focused on corporate targets, looking to understand company structures before launching more targeted attacks.

For most families, no immediate action is needed unless someone in your household uses GitHub for work purposes.

1. Check your GitHub account activity for any logins you don't recognize.
2. Enable two-factor authentication on your GitHub account if you haven't already.
3. Report any suspicious activity to your company's IT department immediately.
4. Never reuse your GitHub password on other websites or services. To stay protected long term, treat your work accounts with extra care. Use unique, strong passwords for every work-related service. Enable two-factor authentication wherever it's offered. If you have old accounts you no longer use on any platform, either delete them or secure them with updated passwords and security settings. Abandoned accounts can become tools for attackers.