GitHub disclosed on October 23, 2026 that a routing change caused some Enterprise Managed User accounts deprovisioned through SCIM to be deleted instead of entering the expected suspended and obfuscated state. The affected path operated from June 1 through June 13. GitHub says approximately 12,285 accounts across multiple enterprises were affected; most had already been suspended and hard-deprovisioned, while 76 were active when deleted.
The visible symptom was lost enterprise attribution
Affected people appeared as ghost users in issues, pull requests and audit logs rather than as the enterprise’s expected suspended, obfuscated records. GitHub says enterprises can identify impact by looking for a `user.delete` event for an Enterprise Managed User during the June 1–13 window. If no such event appears, GitHub says the enterprise was not affected.
The company attributes the incident to a new deprovisioning path that did not correctly check whether an account was an Enterprise Managed User. GitHub disabled the path on June 13. This is GitHub’s incident account; the published notice does not include an independent audit or a customer-by-customer impact list.
Related sources: GitHub: EMU deletions fix ↗
GitHub says the records returned to the expected state
GitHub reports that it changed code to prevent a recurrence and restored affected records in October to suspended and obfuscated status, preserving traceability and audit history. It says enterprise owners do not need to take action. Hard-deprovisioned EMU accounts cannot be reprovisioned by design, so GitHub says the incident does not change that workflow.
Restoration of the GitHub record should be separated from broader identity assurance. Organizations may still want to retain the relevant audit export, confirm downstream integrations did not act on the temporary ghost-user state and document whether investigations, legal holds or ownership reports relied on attribution during the affected period.
Related sources: GitHub: EMU deletions fix ↗ · GitHub Docs: enterprise SCIM endpoint behavior ↗
Identity lifecycle testing should cover audit-history integrity
Canadian organizations using enterprise identity automation should test joiner, mover, suspension and hard-deprovisioning paths in a non-production environment. Monitoring should alert when a routine SCIM operation produces a destructive event type or changes attribution on historical work.
Keep the identity provider, GitHub audit log and internal change record aligned. The useful control is not a generic “SCIM enabled” checkbox; it is evidence that expected states, reversibility boundaries and historical attribution remain correct after a workflow or vendor update.
Sources and editorial method
We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.
- GitHub: EMU deletions fix ↗ — October 23 incident disclosure; affected window, account counts, cause and restoration.
- GitHub Docs: enterprise SCIM endpoint behavior ↗ — Official reference describing permanent suspension, obfuscation and irreversible deletion semantics.