On 6 June 2024, an anonymous user on 4chan posted a torrent of a 273GB archive described as "Basically all source code belonging to The New York Times Company." The Times confirmed that the data had been stolen from its GitHub repositories in January 2024, after "a credential to a cloud-based third-party code platform was inadvertently made available," and later confirmed that the platform was GitHub. A README in the archive said the attacker used an exposed GitHub token. The leak listed 6,223 folders and, according to the poster, around 5,000 repositories and 3.6 million files, including IT documentation, infrastructure tools and, reportedly, the source code for Wordle. The Times said there was no indication of unauthorised access to Times-owned systems or impact on its operations. When GitGuardian later scanned the leaked code, it found 4,875 unique secrets committed by Times developers, at least 228 of which it classed as critical, such as AWS keys, HashiCorp Vault tokens and Auth0 keys.
Key takeaways
- An exposed GitHub credential gave an attacker access to The New York Times' repositories in January 2024.
- The Times said the issue was quickly identified; the stolen code was posted on 4chan in June 2024.
- The 273GB archive reportedly held around 5,000 repositories, including IT documentation, infrastructure tools and Wordle.
- GitGuardian found 4,875 unique secrets in the leaked code, including at least 228 critical keys.
- The identity lesson: one source control token can expose every repository, and every secret inside them, so tokens must be scoped and repositories kept free of secrets.
At a glance
| Organisation | The New York Times |
|---|---|
| When | Access in January 2024; leaked 6 June 2024 |
| Attacker | An anonymous 4chan user; unattributed |
| Entry point | A GitHub credential that was inadvertently made available |
| Identities abused | A GitHub token, according to the attacker's README; secrets in the stolen code were exposed as a result |
| Impact | About 270GB of source code and internal data leaked; 4,875 unique secrets exposed in the code |
| Category | NHI. Incident class: confirmed NHI breach (exposed source control token) |
What happened
BleepingComputer reported that the Times' internal source code and data "was leaked on the 4chan message board after being stolen from the company's GitHub repositories in January 2024." The 4chan post claimed: "There are around 5 thousand repos (out of them less than 30 are additionally encrypted I think), 3.6 million files total, uncompressed tar." The attacker shared a list of "6,223 folders stolen from the company's GitHub repository," and "A 'readme' file in the archive states that the threat actor used an exposed GitHub token to access the company's repositories and steal the data."
The Times gave the same statement to BleepingComputer and CSO Online: "The underlying event related to yesterday's posting occurred in January 2024 when a credential to a cloud-based third-party code platform was inadvertently made available. The issue was quickly identified and we took appropriate measures in response at the time. There is no indication of unauthorized access to Times-owned systems nor impact to our operations related to this event." A spokesperson confirmed that the platform was GitHub.
The bigger risk was what the code contained. GitGuardian scanned the leaked repositories and "discovered 4,875 unique secrets that were leaked by developers from the New York Times," counting only secrets committed from nytimes.com addresses. It said "At least 228 of the secrets discovered are what we would consider Critical Keys," including HashiCorp Vault tokens, Auth0 keys and AWS keys, and noted it did not validate them. CSO Online quoted Yakir Kadkoda of Aqua Security: "from this large amount of data, attackers can extract tokens and sensitive information, identify vulnerabilities by examining the code, and discover internal and external domain names and IP addresses."
Timeline
| Date | Event |
|---|---|
| January 2024 | A GitHub credential is exposed and used to access The Times' repositories; The Times responds. |
| 6 June 2024 | The archive is posted on 4chan and noticed by vx-underground. |
| 8 June 2024 | BleepingComputer reports The Times' confirmation. |
| 2 August 2024 | GitGuardian publishes its analysis of secrets in the leaked code. |
How it happened: the identity attack path
- Token exposed. A GitHub credential was inadvertently made available; The Times did not say where.
- Repositories accessed. The attacker used the token to access The Times' GitHub repositories.
- Code copied. About 270GB of code and data was taken in January 2024.
- Public leak. The archive was posted on 4chan in June 2024.
- Secrets exposed. Thousands of secrets in the code became available to anyone who downloaded it.
Impact
- Code: around 5,000 repositories and 3.6 million files, according to the leaker.
- Secrets: 4,875 unique secrets committed by Times developers, at least 228 critical, according to GitGuardian.
- Operations: no indication of access to Times-owned systems or operational impact, according to The Times.
What this means for NHI governance
This is a two-layer non-human identity failure. The first layer was the GitHub token itself, which reached enough repositories to copy nearly everything. The second was the secrets inside those repositories, which turned a source code leak into a potential credential leak across cloud, identity and email services.
Source control tokens should be fine-grained, short-lived and scoped to the repositories a task needs, and repositories and their history should be kept free of live secrets. See our Secrets Management Guide and CI/CD Pipeline Identity Security Guide.
Recommendations
- Scope GitHub tokens tightly. Use fine-grained tokens or GitHub Apps limited to specific repositories. See our NHI Authentication Guide.
- Remove secrets from code and history. Scan repositories and move secrets to a vault. See the Secrets Management Guide.
- Rotate after a code leak. Treat every secret in leaked code as compromised. See the Leaked Credential Response Playbook.
- Alert on mass cloning. Unusual bulk repository access should trigger a response. See the ITDR Guide.
- Plant canary tokens. Decoy credentials in code reveal when a leak is being used.
Frequently asked questions
How was The New York Times' source code stolen?
The Times said a credential for GitHub was inadvertently made available in January 2024. The attacker's README said an exposed GitHub token was used to access the repositories.
What was in the leak?
About 270GB of source code and internal data, including IT documentation, infrastructure tools and reportedly the Wordle game.
Were secrets exposed in the leaked code?
Yes. GitGuardian found 4,875 unique secrets committed by Times developers, at least 228 of them critical, though it did not check whether they were still valid.
Related NHI Mgmt Group resources
Twitch Breach 2021 · Home Depot Token Exposure 2025 · Secrets Management Guide · CI/CD Pipeline Identity Security Guide · Leaked Credential Response Playbook
How NHI Mgmt Group can help
One token can open every repository, and every secret in them. We help teams scope source control credentials, clean secrets from code and respond fast to leaks. See our NHI and AI agent security training.
References
- BleepingComputer: New York Times source code stolen using exposed GitHub token (8 June 2024)
- Security Affairs: New York Times source code compromised via exposed GitHub token (8 June 2024)
- CSO Online: New York Times plays down impact of source code leak (10 June 2024)
- GitGuardian: The Secrets of the New York Times Source Code Breach (2 August 2024)