Home Depot Breach: Year-Long Token Exposure Risks Systems

Executive Summary

In November 2025, Home Depot faced a significant cybersecurity breach when a GitHub access token was exposed for over a year, compromising internal systems and critical source code repositories. The issue, which originated in early 2024, was discovered by security researcher Ben Zimmermann. Despite multiple warnings, Home Depot failed to address the vulnerability until media pressure forced action. This oversight left sensitive credentials at risk, potentially allowing unauthorized access to proprietary information. The incident highlights the importance of robust cybersecurity measures and employee training to prevent similar exposures in the future.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• Early 2024: Home Depot’s GitHub access token is inadvertently published online.
• November 2025: Security researcher discovers the exposed token and its implications.
• Late 2025: Media intervention prompts Home Depot to rectify the situation after months of inaction.

Data Compromised

• The exposed GitHub token provided full access to hundreds of private repositories.
• Potentially sensitive internal systems and source code were at risk due to the oversight.
• Credentials linked to the access token could have been exploited for unauthorized activities.

Impact Assessment

• Home Depot’s reputation was at stake due to negligence in securing critical access credentials.
• Financial implications could arise from potential exploitation of sensitive data.
• The breach raised concerns about the effectiveness of existing security protocols within the organization.

Company Response

• Following media pressure, Home Depot initiated a review of its security practices.
• Steps were taken to revoke the exposed token and secure affected repositories.
• Management acknowledged the oversight and committed to improving employee training on cybersecurity best practices.

Security Implications

• This incident underscores the importance of proper token management and the risks of public exposure.
• Organizations must implement strict protocols to prevent unauthorized access to sensitive credentials.
• Regular audits and employee training are essential to mitigate risks associated with human error.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.