Meta Hackers Stole Data on 1,500 People via GitHub Repositories
Hackers used stolen credentials to access Meta’s GitHub accounts, stealing code and personal data on roughly 1,500 individuals, mostly US employees.
Key points
- Attackers accessed Meta’s GitHub repositories using stolen employee credentials.
- Personal data on approximately 1,500 people was exfiltrated alongside software code.
- Meta states its internal systems were not breached and no product vulnerability was involved.
Meta confirmed that hackers stole personal data belonging to approximately 1,500 individuals after gaining unauthorized access to the company’s GitHub repositories. The social media giant disclosed the incident on October 13, noting that the intruders used stolen credentials from an employee to enter the platform. Most of the affected individuals are Meta employees located in the United States.
A spokesperson for Meta told SecurityWeek that the intrusion did not involve a vulnerability in any Meta product, nor did it breach the company’s internal systems. The attackers accessed the external code hosting service rather than Meta’s core infrastructure. The company detected the unauthorized access several weeks ago, immediately cut off the attackers’ ability to view or download files, and engaged GitHub as well as law enforcement agencies to investigate the scope of the theft.
Context and Background
The data stolen by the attackers consisted primarily of business information, which accounted for roughly 99% of the total exfiltrated material. This bulk comprised software code for various Meta products. Personal information made up the remaining 1% of the stolen data. Meta stated that this personal data should not have been present in the repositories, as storing such information on GitHub violates company policy. An employee had mistakenly added the sensitive files to the code hosting environment.
Meta has not specified the exact types of personal information that were taken. However, the company noted that a significant portion of what appeared to be personal data was actually synthetic or anonymized test data. This mixture may make it difficult for the attackers to distinguish between real records and dummy data. Based on the investigation conducted with GitHub so far, Meta does not believe the hackers were specifically targeting its data or had a particular motive related to the company’s intellectual property.
Who Is Affected
Notifications to the affected individuals began on Tuesday, October 13. Meta is currently in the process of informing all roughly 1,500 people whose data was compromised. The majority of these victims are employees based in the United States. The company is also notifying relevant regulatory bodies about the breach. Meta has not published a formal statement on its own newsroom site, relying instead on comments provided to SecurityWeek.
In response to the incident, Meta has rotated secrets found in the affected repositories and implemented new controls to prevent user data from being stored on GitHub. The company is working with internal teams to ensure compliance and is adding proactive scanning tools to catch any user data that might be uploaded by mistake in the future. Meta is offering credit monitoring and dark web monitoring services to the affected individuals as part of its remediation efforts.
What should you do?
Meta has not identified the group responsible for the breach. The incident highlights the risks associated with storing sensitive data in external code repositories, even when access is controlled by credentials. While Meta’s internal systems remained secure, the exposure of personal data through a third-party platform underscores the importance of strict data handling policies and regular auditing of external tools used by employees.
What to do and how to stay safe: Meta
- Monitor credit reports and financial statements regularly for any unauthorized activity or new accounts opened in your name.
- Enroll in identity theft protection services if you are among the affected individuals to receive alerts about suspicious use of your personal information.
- Review and update passwords for accounts that may have been linked to the compromised credentials, ensuring they are unique and complex.
- Watch for phishing attempts that may reference this breach, as attackers often use recent news to trick victims into revealing more information.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did hackers breach Meta’s internal systems?
No, Meta stated that its internal systems were not breached and the incident did not involve a vulnerability in any Meta product.
How many people were affected by the data theft?
Approximately 1,500 people had their personal data stolen, most of whom are Meta employees in the US.
What kind of data was stolen?
Attackers stole mostly software code, with a small amount of personal data that had been mistakenly uploaded to GitHub repositories.
