Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Checkmarx

Disclosed Apr 26, 2026Confirmed

Official notice

Checkmarx confirms LAPSUS$ leak of GitHub data after Trivy-linked compromise

Application security firm Checkmarx said attackers used credentials from the Trivy supply-chain attack to access a private GitHub repository, pushed malicious KICS Docker images and extensions, and leaked about 96 GB via LAPSUS$. It said no customer data was stored there.

What is known

People affectedNot stated in the sources we have
DisclosedApr 26, 2026
DiscoveredMar 23, 2026
AttackSupply chain
Data exposedCredentials and tokensAPI keysSource code
SectorTech · IL
StatusConfirmed
Part ofTrivy (2026)

Sources

Official noticecheckmarx.com
Checkmarx security update April 26
Newsbleepingcomputer.com
Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data

Notices filed

TotalApr 26
ResearchCount not stated

Same campaign

CiscoSupply chain exposed source code and API keys.Supply chainTechUSUnverifiedMar 31European CommissionSupply chain exposed names, emails, messages and internal documents.Supply chainGovernmentBEMar 27LiteLLMMalware slipped into popular LiteLLM AI gateway package stole developer credentialsSupply chainAIUSUnverifiedMar 24Aqua SecurityTrivy scanner releases and GitHub Actions hijacked to push credential stealerSupply chainTechILUnverifiedMar 21
History of this record
Added2026-09-25
First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Checkmarx