Meta Hackers Stole Code and Data of 1,500 via GitHub Repos
Meta says hackers used stolen credentials to access GitHub repositories, taking code and limited personal data of roughly 1,500 people, mostly US employees.
Key points
- Hackers accessed Meta GitHub repositories using stolen employee credentials.
- Roughly 1,500 individuals, mostly US employees, were impacted by the breach.
- Meta rotated secrets and implemented new controls to prevent data storage on GitHub.
Meta is notifying approximately 1,500 people that their personal information was compromised after hackers accessed several of the company’s GitHub repositories. The tech giant confirmed the intrusion was detected a few weeks ago, with notifications to affected individuals beginning on Tuesday.
According to Meta, an external group gained entry to these repositories by using an employee’s stolen credentials. The company’s security team immediately shut down the attackers’ access and engaged both GitHub and law enforcement agencies to investigate the incident further.
Incident Scope and Data Impact
Meta told SecurityWeek that 99% of the data exfiltrated by the hackers consisted of business data, specifically software code related to various products. The remaining 1% comprised personal data that had been mistakenly added to the repositories in violation of company policy.
The company has not disclosed the specific types of personal information involved. However, Meta noted that a significant portion of the data appearing to be personal was actually synthetic or anonymized test data. This suggests attackers may struggle to distinguish genuine records from test entries.
Affected Individuals and Response
Most of the roughly 1,500 affected individuals are Meta employees located in the United States. These individuals are being offered credit monitoring and dark web monitoring services as a precautionary measure following the breach.
Meta stated that its internal systems were not breached and that there was no vulnerability in any Meta product. The company is also notifying relevant regulators about the incident. Based on its investigation with GitHub, Meta does not believe the hackers were specifically targeting its data.
Remediation and Security Measures
In response to the incident, Meta rotated secrets found in the affected repositories and hardened its product security to address risks stemming from access to its business data. The company is working with teams that use GitHub to ensure user data is kept off the platform.
As a second line of defense, Meta is adding controls for proactive scanning to detect any user data uploaded by mistake. A spokesperson said the company implemented new controls to prevent user data from being stored in GitHub and worked with GitHub on additional protective measures.
What should you do?
Organizations should audit their source code repositories for accidentally committed sensitive data or credentials. Teams should enforce strict access controls and monitor for unusual login activity. Regularly rotating secrets and implementing automated scanning for sensitive data can reduce exposure.
What to do and how to stay safe: Meta
- Audit source code repositories for accidentally committed sensitive data or credentials.
- Enforce strict access controls and monitor for unusual login activity.
- Regularly rotate secrets and implement automated scanning for sensitive data.
- Notify affected individuals and regulators promptly if a breach occurs.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Meta GitHub breach?
Approximately 1,500 people, mostly US employees, were affected by the breach.
What kind of data was stolen from the GitHub repositories?
Hackers stole 99% business data (software code) and 1% personal data.
Did Meta experience a vulnerability in its products?
No, Meta stated there was no vulnerability in any Meta product.
