Lapsus$ Claims AstraZeneca Breach Exposed Source Code and Internal Credentials

Lapsus$ claimed it breached AstraZeneca and published allegedly stolen data on its blog and a dark web leak forum, with reports saying the cache includes full source code, employee databases, GitHub Enterprise user data, internal API keys, AWS keys, service accounts, and MongoDB and MySQL credentials. Researchers who reviewed sample files said parts of the leak appeared credible, citing source code tree structures, GitHub user information, employee details tied to AstraZeneca-related clinical research companies, and GitHub Actions logs containing developer email addresses and hardcoded secrets, including RSA private keys and database credentials.

The exposed material appears to be concentrated on AstraZeneca’s technical infrastructure and employee information rather than patient medical records, but the incident raises immediate risks if any leaked credentials remain active. Valid keys and account data could enable follow-on intrusions into AstraZeneca systems, targeted phishing and social engineering against staff, and deeper analysis of proprietary code and internal environments by attackers seeking intellectual property or additional access.