New York Times source code stolen using exposed GitHub token
by nlqip
![The New York Times building](https://kartwheelnewz.info/wp-content/uploads/2024/06/New-York-Times-source-code-stolen-using-exposed-GitHub-token.jpg)
Internal source code and data belonging to The New York Times was leaked on the 4chan message board after being stolen from the company’s GitHub repositories in January 2024, The Times confirmed to BleepingComputer.
As first seen by VX-Underground, the internal data was leaked on Thursday by an anonymous user who posted a torrent to a 273GB archive containing the stolen data.
“Basically all source code belonging to The New York Times Company, 270GB,” reads the 4chan forum post.
“There are around 5 thousand repos (out of them less than 30 are additionally encrypted I think), 3.6 million files total, uncompressed tar.”
![Leak of New York Times source code on 4chan](https://www.bleepstatic.com/images/news/security/attacks/n/new-york-times/github-4chan/4chan.jpg)
Source: BleepingComputer
While BleepingComputer did not download the archive, the threat actor shared a text file containing a complete list of the 6,223 folders stolen from the company’s GitHub repository.
The folder names indicate that a wide variety of information was stolen, including IT documentation, infrastructure tools, and source code, allegedly including the viral Wordle game.
A ‘readme’ file in the archive states that the threat actor used an exposed GitHub token to access the company’s repositories and steal the data.
In a statement to BleepingComputer, The Times said the breach occurred in January 2024 after credentials for a cloud-based third-party code platform were exposed. A subsequent email confirmed this code platform was GitHub.
“The underlying event related to yesterday’s posting occurred in January 2024 when a credential to a cloud-based third-party code platform was inadvertently made available. The issue was quickly identified and we took appropriate measures in response at the time. There is no indication of unauthorized access to Times-owned systems nor impact to our operations related to this event. Our security measures include continuous monitoring for anomalous activity.”
❖ The New York Times
The company said that the breach of its GitHub account did not affect its internal corporate systems and had no impact on its operations.
The Times leak is the second one published to 4chan this week, with the first being a leak of 415MB of stolen internal documents for Disney’s Club Penguin game.
Sources exclusively told BleepingComputer that the Club Penguin leak was part of a more significant breach of Disney’s Confluence server, where the threat actors stole 2.5 GB of internal corporate data.
It is not known if it was the same person who conducted the New York Times and Disney breaches.
Source link
lol
Internal source code and data belonging to The New York Times was leaked on the 4chan message board after being stolen from the company’s GitHub repositories in January 2024, The Times confirmed to BleepingComputer. As first seen by VX-Underground, the internal data was leaked on Thursday by an anonymous user who posted a torrent to a…
Recent Posts
- Bitcoin ATM scams skyrocket – Week in security with Tony Anscombe
- North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams
- FBI Cracks Down on Dark Web Marketplace Managed by Russian and Kazakh Nationals
- ESET Research Podcast: HotPage
- A Vulnerability in SonicWall SonicOS Management Access and SSLVPN Could Allow for Unauthorized Resource Access