This article is based on reporting originally published by ZDNet and BleepingComputer, with the story first surfacing around May 2020. The original source credited by BestDevOps is Hindustan Times, which itself cited ZDNet.
What Happened
A hacker operating under the name Shiny Hunters gained access to a Microsoft employee’s GitHub account and used it to browse and exfiltrate content from Microsoft’s private GitHub repositories. The attacker contacted BleepingComputer directly, claiming to have obtained more than 500 GB of data from those repositories.
The breach is believed to have occurred in March 2020, though it only came to public attention in May when the hacker began discussing plans to publish some of the stolen material on a hacking forum.
Scope of the Breach
According to reporting by ZDNet, the hacker is believed to have accessed approximately 1,200 private repositories. However, multiple Microsoft employees indicated that no source code from high-value or consumer-facing products — such as Windows or Microsoft Office — was among the stolen data. This suggests the compromised repositories likely contained internal tools, samples, or test projects rather than core product source code.
Some Microsoft engineers initially described the incident as a scam but later walked back those statements after other employees confirmed at least partial authenticity of the hacker’s claims.
Microsoft’s Response
A Microsoft spokesperson confirmed to ZDNet that the company was investigating the incident but did not publicly disclose further details about the scope of the compromise, which accounts were affected, or what specific repositories were accessed.
Who Is Shiny Hunters?
ZDNet reported that the threat actor behind this intrusion is believed to be the same individual responsible for leaking approximately 15 million user records from Tokopedia, Indonesia’s largest e-commerce platform, around the same period. This suggests a pattern of targeting large organizations and exfiltrating data for public release or sale on underground forums.
Key Takeaways for DevOps and Security Teams
- Account compromise is a major attack vector for SCM platforms: Even large enterprises with mature security programs can have individual employee accounts targeted. Credential phishing or credential stuffing remain effective ways to gain entry to source code management systems like GitHub.
- Private repositories are not inherently secure: Repository visibility settings control who can browse code within the platform, but they do not protect against account takeover. Access controls must be paired with strong authentication.
- Enforce MFA on all GitHub accounts: Mandatory multi-factor authentication (MFA) for every account — especially those with access to private or internal repositories — significantly raises the barrier for account takeover attacks.
- Apply least-privilege access to repositories: Not every developer needs access to every private repository. Scoping access reduces the blast radius of a compromised account.
- Monitor for anomalous repository access: GitHub provides audit logs at the organization level. Alerts on bulk repository cloning, unusual access times, or access from new locations or IPs can help detect intrusions earlier.
- Treat insider-adjacent access as a threat model: Once an attacker controls a legitimate employee account, they inherit all of that account’s permissions. Zero-trust principles — such as short-lived tokens and just-in-time access — limit what a compromised account can reach.
Further Reading
For the original reporting, refer to ZDNet and BleepingComputer’s coverage from May 2020. GitHub’s own documentation on organization security settings and audit logging provides practical guidance for hardening your organization against similar incidents.