---
title: "Hackers stole data from 3,800 GitHub internal repositories"
description: "GitHub confirmed attackers used a poisoned VS Code extension to compromise an employee device and steal data from thousands of internal repos."
url: https://kurddevelopers.com/en/news/github-internal-repositories-breach
language: en # English
type: news
published: 2026-05-20T13:25:00.000Z
updated: 2026-11-02T04:23:20.000Z
author: "Osamah Ismail"
author_url: https://kurddevelopers.com/en/author/1
section: "Security"
tags: ["GitHub","Security","VS Code","Breach","Microsoft"]
sources: ["TechCrunch","GitHub"]
image: https://kurddevelopers.com/uploads/2026/11/img-20190506-125609-9fd345ca.jpg
translations:
  ku: https://kurddevelopers.com/news/github-internal-repositories-breach
  ar: https://kurddevelopers.com/ar/news/github-internal-repositories-breach
publisher: Kurd Developers
publisher_url: https://kurddevelopers.com/
---

# Hackers stole data from 3,800 GitHub internal repositories

> GitHub confirmed attackers used a poisoned VS Code extension to compromise an employee device and steal data from thousands of internal repos.

![Image: GitHub](https://kurddevelopers.com/uploads/2026/11/img-20190506-125609-9fd345ca.jpg)

## What happened
**GitHub**, owned by Microsoft, confirmed attackers stole data from about **3,800 internal repositories**.

## How
- A poisoned **VS Code extension** compromised an employee's device. GitHub didn't name it.
- Hacking group **TeamPCP** claimed credit and is reportedly selling the data on a cybercrime forum.

## Customers
GitHub said it found "no evidence of impact to customer information stored outside of GitHub's internal repositories." The investigation is ongoing.

## Tip
Only install VS Code extensions from sources you trust.

**Sources:** TechCrunch, GitHub

---

Published by [Kurd Developers](https://kurddevelopers.com/) on 2026-05-20. Cite as: “Hackers stole data from 3,800 GitHub internal repositories”, Kurd Developers, https://kurddevelopers.com/en/news/github-internal-repositories-breach