Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data

Checkmarx confirmed that the LAPSUS$ group used credentials obtained from a March 23 Trivy supply‑chain incident to access the company's GitHub repository, publish malicious code, and later release a 96GB data package; on April 22 attackers also published malicious Docker images and VSCode/Open VSX extensions for Checkmarx’s KICS scanner that reportedly stole credentials, keys, tokens, and configuration files while an investigation and forensic analysis are ongoing.