U.S. federal cybersecurity agency CISA said it did not have a prepared response plan for a cybersecurity incident that began in May, according to a postmortem report released on Friday. The agency said its staff had to develop a playbook during the early stages of the incident after an investigative reporter alerted them that a contractor had posted sensitive credentials for government systems on a publicly accessible GitHub repository. The researcher who discovered the exposed credentials attempted to contact the contractor without success, and only after the reporter reached CISA did the agency remove the repository and replace the credentials. CISA stated that no customer or mission data was compromised and thanked the researcher and reporter for their assistance. The agency noted that its procedures for allowing security researchers to report potential incidents were not clearly defined and that it has updated those channels to improve speed and ease of reporting. CISA has been without a permanent director since January 2025, when President Donald Trump began his second term, and has experienced workforce reductions, furloughs, and layoffs affecting roughly one‑third of its staff.