GitHub Account Compromised – Repositories Deleted and Replaced

[codewithzeez]

Select Topic Area

Show & Tell

Body

My GitHub account appears to have been compromised.

An unauthorized party has gained access to my account and performed the following actions:

Deleted all of my original repositories
Replaced them with auto-generated repositories
Left a ransom message stating that my production database backups were stolen and asking me to contact them via Telegram [redacted due to security concerns]

Example of the malicious message:
"6571c39a-b707-462f-bfdb-c605eb2ca148
All production database backups have been deleted from your systems and securely stored in our databases."

I did not authorize any of these actions.
Please let me know if you need any additional information.

[queenofcorgis]

Hi @codewithzeez

This community is managed by GitHub employees, but it is not a support forum. The only place to go for answers to account-specific questions like this one is opening a ticket on our Support page.

This is a public forum, and the community is unable to assist with nor escalate your ticket, but we can assure you it is in the right place. It will be answered in the order it was received based on our team's resources and the amount of tickets ahead of yours.

As no other Community Discussions team members will be able to provide additional help with account related questions I am going to close this discussion. We appreciate your understanding!