GitHub restores 12,285 accounts it wrongly deleted in June
A bug in a deprovisioning pathway deleted Enterprise Managed User accounts outright instead of suspending them, leaving ghost users in issues and audit logs for months.
GitHub said on 23 October that it has restored around 12,285 Enterprise Managed User (EMU) accounts that a bug deleted outright instead of suspending and obfuscating them, which is what GitHub’s offboarding is meant to do. The cause was a new deprovisioning pathway deployed on 1 June that failed to check whether an account was an EMU account before running. GitHub disabled the path on 13 June, once the bug was found.
Most of the affected accounts were already suspended, so the deletion made little visible difference. But 76 were still active, and all of them turned into ghost users: stripped identities that kept showing up in issues, pull requests and audit logs with no way to resolve back to a person. GitHub says enterprise owners can check whether they were hit by searching their audit log for user.delete events between 1 and 13 June 2026. The restored accounts are now back in their proper suspended, obfuscated state, and no action is required.
Why it matters: if you run GitHub Enterprise Cloud with Enterprise Managed Users, an account that silently vanished in early June wasn’t necessarily someone’s mistake, it may have been this bug. The audit log is the only way to confirm it, and GitHub says the deprovisioning code has been changed to stop it happening again.