New York Times source code stolen with an exposed GitHub credential
In June 2024 a user posted about 273 GB of New York Times internal source code on 4chan. The Times confirmed that a credential for a third-party code platform, later confirmed to be GitHub, had been inadvertently exposed in January 2024 and used to take the repositories, and said its internal systems and operations were not affected.
- Victim
- The New York Times
- Industry
- Media and streaming
- Country
- United States
- Intrusion began
- Jan 2024
- First disclosed
- Jun 10, 2024
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Credential storage
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
An exposed token with read access to an organization's repositories is a source code breach waiting for someone to notice. Secret scanning with immediate revocation, and fine-grained short-lived tokens, close the window.
Go deeper on SWI
- Technique: Secrets in repositories and CI
Sources
- New York Times plays down impact of source code leak, CSO Online, Jun 10, 2024
- New York Times responds to source code leak, SecurityWeek, Jun 10, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Internet Archive user database theft and Zendesk token abuse 2024 · Exposed secrets
- Sisense breach exposing customer credentials, prompting a CISA alert 2024 · Exposed secrets
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
- Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). New York Times source code stolen with an exposed GitHub credential. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-new-york-times-exposed-github-token/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.