GitHub says bug exposed some plaintext passwords

A small but unspecified number of GitHub staff could have seen plaintext passwords.
Written by Zack Whittaker, Contributor

(Image: file photo)

GitHub has said a bug exposed some user passwords -- in plaintext.

The code repository site, with more than 27 million users as of last year, sent an email to affected users Tuesday.

Read also: Security 101: Here's how to keep your data private, step by step

"During the course of regular auditing, GitHub discovered that a recently introduced bug exposed a small number of users' passwords to our internal logging system," said the email, received by some users.

The email said that a handful of GitHub staff could have seen those passwords -- and that it's "unlikely" that any GitHub staff accessed the site's internal logs.

"We have corrected this, but you'll need to reset your password to regain access to your account," the email added.

ZDNet reached out to several users who received the email and verified its authenticity.

It's not known how many users received the email. We've reached out to GitHub prior to publication with questions but did not immediately hear back. If that changes, we'll update.

It's unclear exactly how this bug occurred. GitHub's explanation was that it stores user passwords with bcrypt, a stronger password hashing algorithm, but that the bug "resulted in our secure internal logs recording plaintext user passwords when users initiated a password reset."

"Rest assured, these passwords were not accessible to the public or other GitHub users at any time," the email said.

Read also: VPN services 2018: The ultimate guide to protecting your data on the internet

GitHub said it "has not been hacked or compromised in any way."

In 2016, the company reset some user passwords after it found some accounts had fallen victim to a password reuse attack, where credentials used on other sites are leaked and used to access accounts on other sites.

Editorial standards