The U.S. cybersecurity agency CISA revealed that it had no prepared response framework when a contractor employee accidentally published sensitive government system credentials to a public online repository in May. The breach remained unaddressed until investigative journalist Brian Krebs contacted the agency after learning of the exposure from a security researcher; only then did CISA take the repository offline and revoke the compromised access credentials. The incident prompted a post-mortem that acknowledged the agency's staff spent valuable time constructing their response procedures during the crisis itself, rather than executing a pre-established plan.

In its review, CISA identified systemic weaknesses including unclear channels for security researchers to report vulnerabilities to the agency, and emphasized the importance of preparing response frameworks in advance. The disclosure of the agency's unpreparedness comes amid broader operational challenges, including workforce reductions affecting roughly a third of CISA's staff and the agency operating without a permanent director since the Trump administration took office in January 2025.