Major data breach at The New York Times exposes internal source code and IT documentation

The New York Times experienced a significant data breach involving its internal source code and IT documentation, as reported by Bleeping Computer. The compromised data, amounting to 270 GB, was uploaded as a torrent file on the anonymous message board 4chan. The post claimed the data included over 5,000 repositories with about 3.6 million files. The New York Times confirmed the breach, ensuring its internal corporate systems and operations remained unaffected.

The breach was first disclosed on June 6, 2024, by vx-underground on Twitter, stating the data appeared to include extensive IT documentation, infrastructure tools, and the source code for the popular game Wordle. The New York Times clarified that the breach stemmed from user credentials leaked from GitHub in January 2024. The company promptly addressed the issue and implemented measures to prevent further unauthorized access.

The leaked data purportedly includes sensitive internal communications from Slack channels, detailed IT architecture documents, and a range of authentication methods, such as URLs, passwords, secret keys, and API tokens. It comprises a database of 1,500 users from The New York Times Education site, containing their names, email addresses, and hashed passwords. The company stressed that the leak involved only IT department data, excluding news and editorial content.

Disney faced a similar breach in related incidents when its Club Penguin game data leaked, including corporate strategies and internal tools. Additionally, a Google data leak last week revealed several privacy and security issues, highlighting concerns over handling user data, especially concerning minors.