Between June 1 and June 13, 2026, some Enterprise Managed User accounts that were deprovisioned through SCIM were incorrectly deleted instead of being suspended and obfuscated as expected.

As a result, affected users appeared as ghost users in issues, pull requests, and audit logs, rather than retaining their expected suspended and obfuscated user records within the enterprise.

Who was affected

This affected approximately 12,285 Enterprise Managed User accounts across multiple enterprises.

Most affected accounts had already been suspended and hard-deprovisioned, which means they couldn’t be reprovisioned by design. A smaller group of 76 accounts were active at the time of deletion.

How to tell if you were affected

You were affected if your enterprise audit logs contain a user.delete event for an Enterprise Managed User account during the June 1 to June 13, 2026 window. If you do not see any such events in that window, your enterprise was not impacted.

If you do see these events, no action is required from you. GitHub is restoring the affected accounts.

What caused the issue

On June 1, 2026, GitHub enabled a change that routed deprovisioning requests through a new path. That path didn’t correctly check whether the account was an Enterprise Managed User account, which caused the affected accounts to be deleted instead of following the expected suspend-and-obfuscate flow.

GitHub contained the issue by disabling the affected path on June 13, 2026.

What we’re doing to fix it

We’ve made code changes to prevent this from happening again. We’ve also restored affected user records in October 2026.

The restoration process returned affected accounts to their expected suspended and obfuscated state, preserving traceability and audit history within the enterprise. Enterprise owners don’t need to take any action.

Hard-deprovisioned Enterprise Managed User accounts can’t be reprovisioned by design, so this issue doesn’t affect the reprovisioning workflow.