When a security story breaks, relationships make the difference
How GitGuardian’s discovery became a rapid-response media story, with about 70 articles globally in a few days.
A federal cybersecurity agency left its own admin keys sitting in a public GitHub repo for six months. Here’s how the story broke, and why rapid response is its own PR skill.
The discovery
On May 14, a cybersecurity researcher, Guillaume Valadon, at our client GitGuardian found a repo called “private CISA.” (Public, of course. The irony writes itself.) Inside: Kubernetes configs, internal docs, a Firefox password dump, and a file literally named important AWS tokens. Active GovCloud credentials, still valid.
The automated alerts had already gone out months earlier. Nobody acted on them. So GitGuardian tried the responsible disclosure playbook, got an acknowledgment and not much else, and the weekend was coming.
Brian Krebs broke the story, and we were pitching key media by 3am, hours after he published.
Getting the right people to act
Guillaume told us his real fear during that window wasn’t someone wiping the systems. It was a state actor quietly grabbing those keys and building persistence inside a government network. You don’t recover from that with a restore. He needed a human at CISA who could act before Friday night, and Krebs could help reach one. CISA moved fast once the right people saw it. The repo was down in about 26 hours. For context, most of GitGuardian’s disclosures take far longer, and plenty never get fixed at all.
Krebs published May 18. By 3am MDT on the 19th, we were pitching key media.
- Find and discloseGitGuardian found the exposed credentials and tried responsible disclosure.
- Reach the right peopleBrian Krebs brought the story to public attention.
- Mobilize the coverageConnect was pitching key media by 3am, hours after Krebs published, with tailored angles and expert video.
The response
By 3am MDT on the 19th, we were reaching out to reporters we know. We already knew exactly who would want this and what angle each one needed: the federal-policy reporters at CyberScoop and The Record, the breach desk at The Hacker News, Dark Reading and SC Media, the wire-it-fast crews at TechCrunch and The Register. These aren’t cold pitches. They’re relationships, and we were handing each reporter the piece their story was missing. We also sent media and analysts a short video of Guillaume walking through what he found, so nobody had to take our word for the technical details. They could watch the expert explain it himself.
The result: about 70 articles globally in a few days. And GitGuardian became the named expert voice on the biggest federal security story of the week. When reporters needed someone to explain what actually happened, they came to GitGuardian.
Why the relationships mattered
This is what we call rapid response, and it’s a different muscle than a planned launch. You can’t build the relationships once the story is live. The reason we could move at 3am is that we already knew which 30 reporters cover this beat, what each one cares about, and how to give them something their competitors wouldn’t have.
If your security story breaks in the wee hours of the morning, the question isn't whether you can write a good pitch. It's whether you've already built the relationships so the right reporters open your email instead of the other hundred they got that morning.
You can’t build the relationships once the story is live.
Holly Hagerman · Managing Partner, Connect Marketing