The federal cybersecurity agency CISA said in May that it had no response plan in place for how to handle cybersecurity incidents after an investigative reporter notified the agency that a contractor had publicly released confidential keys and credentials to access U.S. government systems.
The Department of Homeland Security, CISA, which is tasked with protecting federal networks and protecting critical infrastructure, said in an after-action report Friday that its employees “had to spend time building.” [a playbook] in the early stages of the incident. The agency said it is important for organizations to prepare a handbook that can address “all anticipated needs” rather than scrambling to respond in real time when a security incident occurs.
The agency did not say how long the loss of the handbook delayed CISA's response, and a spokesperson did not immediately respond to TechCrunch's request for comment.
Independent cybersecurity journalist Brian Krebs reported in May that security researchers at the cyber firm GitGuardian alerted him to a large number of passwords stored in publicly accessible GitHub repositories uploaded by employees of a CISA contractor.
Krebs said researchers tried to alert the contractor, but received no response. It was only after Krebs contacted CISA that the agency took the repository offline and revoked and replaced all exposed credentials to prevent possible future abuse.
CISA said no customer or mission data was compromised in the incident and thanked researchers and reporters for their cooperation. The agency said the channels through which security researchers could notify CISA of potential incidents were “not clearly defined” and that it had made changes to make it easier and faster for researchers to contact CISA.
CISA has been without a permanent director since President Donald Trump's second term began in January 2025. CISA has also been affected by job cuts, furloughs, and layoffs since President Trump took office, affecting about one-third of its staff.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.