GitHub gets autoscanned by thousands of malicious actors for keys and credentials on every commit, including the comments lol.

The fact that CISA themselves never saw an automated breach attempt only minutes after pushing to github is the more interesting story here.

Either the contractor is so incompetent that they didn’t have any logging set up and the breach went completely unnoticed for 6 months.

Or this really is some fat honeypot that they won’t admit is a honeypot because they’ve been using it to watch or bait APTs.

Currently, there is no indication that any sensitive data was compromised as a result of this incident

This is literally impossible unless it really was a honeypot. You can demo this yourself in real time. Make a throwaway cloud account on your favorite provider, commit the cloud auth token into a repo, and you will see an automated bot login within minutes.

Commiting any secrets to a public repo should just be considered auto compromised because of how potent it is.

That stuff ususlly gets exposed via poor CI/CD permissions where credentials are required, but straight up file commit is like publicly announcing exactly where you left your house keys lol.