Account suspended

[ecastilloc0511]

Discussion Type

Product Feedback

Discussion Content

Hello GitHub Support Team,
My GitHub account (Emcas152) has been compromised by an unauthorized third party and is currently suspended.
Here is a timeline of what happened based on the security alerts

I received: On October 04, 2026, at 19:26 UTC, I received an alert stating that my two-factor authentication (2FA) recovery codes were viewed.

Shortly after, an unfamiliar email address (michael.miller45881@gmx.com) was added to my account without my consent.

The account is now suspended, and I need help securing it, removing the unauthorized email/changes, and restoring my access.I am the legitimate owner of this account.

Please let me know what verification details or documents you need from me to prove my identity and regain control of my account.Thank you for your prompt assistance.

Best regards,

Edwin Maximiliano Castillo Chapeton

What is the username of the account you're trying to sign in to?

The support team hasn't responded to me yet, so I'd appreciate it if you could help me out with a guide.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[DYNOSuprovo]

When a GitHub account is compromised and an unauthorized email (like the gmx.com address you noticed) is attached after 2FA recovery codes are viewed, GitHub’s Trust & Safety system places the account into an administrative suspension/lock to prevent the attacker from deleting repositories, transferring organizations, or pushing malicious code.

Because GitHub Support cannot verify identity through national IDs or passports (GitHub does not store government identity documents for privacy reasons), they verify legitimate ownership through technical and cryptographic account proofs.

Here is the exact verification evidence you should prepare and the recovery procedure to follow:

---

1. The Evidence GitHub Support Uses to Verify Ownership

When the Account Security team responds to your ticket, they will ask you to prove ownership using one or more of the following:

A. SSH Key Challenge (The Strongest Proof)

If you had an SSH key attached to Emcas152 before the compromise:

• Support will generate a unique cryptographic nonce/string and ask you to sign it using your private key.
• You will run:

  echo -n "<challenge-string-from-support>" | ssh-keygen -Y sign -n "file" -f ~/.ssh/id_ed25519

  (or your id_rsa) and reply with the generated .sig output. This proves mathematically that you hold the private key matching the public key on the account.

B. Original Primary Email Access

• Support will confirm whether you still have active access to the original email address associated with Emcas152 prior to the attacker adding the gmx.com address.
• They will send an authorization link to that original email to confirm it was not permanently deleted.

C. Billing and Payment Records (If Applicable)

• If Emcas152 ever subscribed to GitHub Pro, Copilot, or GitHub Sponsors:
  • Last 4 digits of the credit/debit card on file.
  • Card expiration date and billing address / postal code.
  • Transaction IDs from past GitHub invoice emails.

D. Git Commit Author History & GPG Signatures

• The commit email and PGP/GPG signing key fingerprint used in recent commits across your repositories.

---

2. How to Route Your Ticket to Account Recovery

If your initial ticket was submitted through a generic inquiry form, it may be delayed in the general queue.

1. Ensure your request is specifically routed via:
   https://support.github.com/contact/account-recovery
2. Select: "My account has been compromised".
3. In your ticket message, explicitly provide:
   • Target Username: Emcas152
   • Original Primary Email: (the email you used to register before the incident)
   • Unauthorized Email Added: michael.miller45881@gmx.com
   • Exact Security Alert Timestamp: October 04, 2026, 19:26 UTC (as shown in your screenshot)
   • Statement: "I have local access to the SSH key and original email previously configured on this account and am prepared to complete cryptographic SSH challenge verification."

---

3. Important Tips While Waiting for Support

• Do NOT open multiple duplicate tickets: Submitting new tickets for the same issue automatically merges them into a single thread and often resets your ticket's position in the triage queue.
• Secure Your Original Email Immediately: Ensure the password for your personal email provider is changed and has 2FA enabled, as attackers often compromise developer email inboxes first to intercept password reset links.

---

Once GitHub Support verifies your SSH signature or original email confirmation, they will remove the unauthorized email address, issue a secure 2FA reset token, and restore your account access. If this guidance helps clarify the recovery process, please mark this as the accepted answer!