Canonical, the company behind the Ubuntu operating system, confirmed over the weekend that one of its GitHub accounts was hacked.
According to Canonical, the attacker hijacked the account on July 6 using compromised GitHub credentials. The hacker used the access to conduct various activities, including to create repositories and issues.
Shortly after the breach was discovered, Canonical removed the compromised account from its organization in GitHub. The investigation is ongoing and the company has promised to provide more details after it’s completed, but so far there is no evidence that the incident impacts source code or personally identifiable information.
“Furthermore, the Launchpad infrastructure where the Ubuntu distribution is built and maintained is disconnected from GitHub and there is also no indication that it has been affected,” Canonical stated.
This incident appears to be far less serious than the breach of the Ubuntu Forums back in 2016, when a hacker exploited a known SQL injection vulnerability in one of the add-ons installed on the site and gained access to data belonging to over 2 million registered users.
Canonical is not the only Linux maker whose GitHub account was targeted in recent years. Roughly one year ago, a GitHub account of the Gentoo Linux distribution was hijacked. In that incident, the attackers planted malicious code and attempted to lock out Gentoo developers from the compromised account.
Related: Arch Linux AUR Repository Compromised
Related: Hard-Coded Credentials Found in Alpine Linux Docker Images

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Siemens License Manager Vulnerabilities Allow ICS Hacking
- CISA Releases Open Source Recovery Tool for ESXiArgs Ransomware
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
Latest News
- Skybox Security Raises $50M, Hires New CEO
- Spies, Hackers, Informants: How China Snoops on the US
- Australian Man Sentenced for Scam Related to Optus Hack
- Chrome 110 Patches 15 Vulnerabilities
- Application Security Protection for the Masses
- Tor Network Under DDoS Pressure for 7 Months
- Siemens License Manager Vulnerabilities Allow ICS Hacking
- UN Experts: North Korean Hackers Stole Record Virtual Assets
