Hi Xalaok,

Thank you for taking the time to write in. I’m sorry for the time it has taken to get back to you—it was certainly longer than we would have liked.

We recently noticed that your GitHub account had a suspicious login. Out of abundance of caution, we’ve forced a password reset on your account. We’ve noticed that you’ve already accessed your account and reset your password, which is great! Thanks for taking the initiative to secure your account.

To protect your account from unauthorised access, please choose a strong and unique password for your account. We have a help article with some recommendations here:
https://docs.github.com/authentication/keeping-your-account-and-data-secure/creating-a-strong-password

We also strongly recommend taking the additional step to secure your account with two-factor authentication. The following guide provides step-by-step instructions:
https://docs.github.com/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication.

While we can’t be certain as to how your account was compromised, a common cause is reusing credentials across multiple online services. An attacker can then obtain a list of email addresses and passwords from one compromised service, and use them to compromise accounts on another. Please note that while individual GitHub accounts may have been compromised via such means, GitHub itself has not been hacked or compromised.

Alternatively, it’s possible that one of your devices may be infected with malware capable of stealing passwords or browser session data. We’d advise reviewing your device security to ensure this isn’t the case.

During the account compromise, it appears that the bad actor starred a number of repositories but we have since unstarred any repositories that were not starred by you. Additionally, the bad actor created some repositories but we see that you have deleted the repository, thank you for doing that!

If you have any further questions or concerns, please don’t hesitate to reach out. We’re here to help.

Kind regards,

Lewis, SDG.

GitHub Support.

Hi there,

Thank you for contacting GitHub Support.

We have cause to believe that your account may have been compromised and misused. In particular, malicious content may have been published using your account. We have placed restrictions on its visibility while we investigate further.

To assist us in this process, please review your account for any content that you don’t recognise. Your account’s security log may assist you in this process. During the review, please look out for two possibilities:

• new repositories, not created by you
• modifications to your existing repositories, not performed by you

If you identify new repositories that were not created by you, please first take note of their URLs, and then delete them by following our documentation here. Do not interact with any of the content in these repositories, as this may result in further compromise. Once you have deleted these repositories, please reply with a list of their URLs.

If you identify modifications to your existing repositories, you have two options:

1. If you are happy to delete the repository (for example, if you have a backup, or you no longer need it), please do so and reply with a list of URLs for any repositories you have deleted.
2. If you need to retain the repository, we can assist you in repairing it. Please do not attempt to modify or explore the repository content yourself. Instead, please send us the relevant URLs, and we will then share further instructions.

If you identify any other suspicious actions on your account, please also inform us of these in your reply. Alternatively, if you still require assistance and can’t locate any malicious or suspicious content, please let us know and we’ll take another look.

Additionally, if you missed this message and are unable to reply, you can start a new support request here: https://support.github.com/contact/cannot_sign_in

If you choose to create a new request, including this ticket number for reference will help us provide the necessary context: # NUM

We are working to resolve your case as soon as possible, and we thank you for your patience and cooperation.

Kind regards,

Lewis, SDG.

GitHub Support.

Hi again,

Thank you for working with us to resolve this. 

Upon review, we have lifted all the restrictions currently imposed on your account. Your account should be available again by now.

For your attention, this kind of unauthorized access often occurs as a result of reusing the same sign in credentials on multiple online services. An attacker is then able to obtain lists of email addresses and passwords from other online services that have been compromised in the past, and try them on GitHub. To note, GitHub has not been hacked or compromised.

Additionally, it’s possible that your system is infected with malware that can steal passwords and browser session data. I would like to suggest that you scan your computer for malware to protect against potential threats. 

Regularly scanning your computer is critical to maintaining optimal cybersecurity. Therefore, I encourage you to make it a regular practice to scan your system at least once a week. Furthermore, it is essential to keep your anti-virus and anti-malware software up-to-date to safeguard against the latest threats.

As for this:

I have a question, are my stars going to be retained?

Yes they will, the stars removed will be those added by the bad actor.

If you have any further questions or concerns, please don’t hesitate to reach out. We’re here to help.

Kind regards,

Lewis, SDG.

GitHub Support.