6:01 PM PDT · July 10, 2026

U.S. federal cybersecurity agency CISA admitted it lacked a ready-made plan for managing security breaches when an incident unfolded in May. The agency learned of the problem after a journalist informed them about a contractor who had left sensitive access keys and passwords openly available online.

CISA, the Homeland Security unit responsible for protecting federal networks and critical infrastructure, disclosed in a Friday postmortem report that its team "had to spend time building [a playbook] during the early stages of the incident." The agency stressed the value of preparing playbooks for "all anticipated needs" so groups can respond effectively instead of improvising under pressure.

The agency did not specify how long the absent playbook slowed its reaction, and a spokesperson did not immediately reply to requests for comment.

Independent cybersecurity journalist Brian Krebs reported in May that a security researcher at cyber firm GitGuardian notified him about large amounts of exposed passwords in a publicly accessible GitHub repository uploaded by an employee of a CISA contractor.

According to Krebs, the researcher attempted to notify the contractor without success. Only after Krebs reached out to CISA did the agency remove the repository and revoke and replace all exposed credentials to block potential misuse.

CISA confirmed that no customer or mission data was exposed and thanked the researcher and reporter for their assistance. The agency noted that its channels for security researchers to report potential incidents "were not well defined," and it has since updated processes to simplify and speed up contact from researchers.

CISA has operated without a permanent director since President Donald Trump's second term began in January 2025. The agency has also faced cuts, furloughs, and layoffs impacting roughly a third of its staff since Trump took office.

Topics

When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.

Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.

He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.