Git ransom campaign incident report

This post details a coordinated effort between GitLab, GitHub, and Bitbucket to educate users on secure best practices following a Git ransomware incident. It outlines the incident details, how user accounts were compromised (likely via external credential leakage), the ransom note, and the methods used by the attacker (automated Git pushes overwriting repositories). It provides guidance on how users can protect themselves by enabling multi-factor authentication, using strong and unique passwords, understanding the risks of personal access tokens, and avoiding exposure of `.git` directories and `.git/config` files. It also offers recovery steps for affected repositories and details platform-specific security features like token scanning and secrets detection.