I have a single failed login from an IP address in Brazil 16 hours ago. And another single failed attempt from an address in Thailand three days ago. No suspicious activity had been logged before that.

The attacker probably tried a password like 'github' on the first pass and 'password' on the second pass.