GitHub Addresses Incident Involving Incorrectly Deleted Enterprise Managed User Accounts

A technical incident between June 1 and June 13, 2026, resulted in approximately 12,285 Enterprise Managed User (EMU) accounts being incorrectly deleted instead of being suspended and obfuscated during SCIM deprovisioning. According to GitHub's engineering disclosure, the issue stemmed from a routing change enabled on June 1, 2026, which failed to correctly identify EMU accounts through the new deprovisioning path. Consequently, affected accounts appeared as ghost users in audit logs, pull requests, and issues instead of maintaining their expected suspended records.

Incident Details and Scope

• Timeline: The affected routing path was active from June 1, 2026, to June 13, 2026, when GitHub contained the issue by disabling the path.
• Impact: Approximately 12,285 accounts across multiple enterprises experienced incorrect deletions.
• Account Status Breakdown: Most affected accounts had previously been suspended and hard-deprovisioned by design and could not be reprovisioned. However, a smaller subset of 76 accounts were active at the time of deletion.

Resolution and Restoration

GitHub reported that code changes have been implemented to prevent recurrence. Furthermore, affected user records were restored in October 2026. This restoration process returned the impacted accounts to their expected suspended and obfuscated states, maintaining audit history and traceability within enterprises.

Practical Implications and Verification

Enterprise administrators do not need to take any action regarding the restoration. Organizations can verify whether they were impacted by reviewing their enterprise audit logs:

• Verification Steps: Check audit logs for any `user.delete` events associated with Enterprise Managed User accounts during the June 1 to June 13, 2026 window.
• No Impact Confirmation: If no such events appear in the specified date range, the enterprise was not affected.
• Action Required: None. GitHub handles the account restoration automatically, and hard-deprovisioned accounts remain unable to be reprovisioned by design.