Meta GitHub Breach Exposes Source Code and Data on 1,500 People
Hackers have stolen the source code of Meta products. They also took personal data on roughly 1,500 people. The attackers gained access to several of the company’s GitHub repositories.
They broke in with stolen credentials from an employee. Meta discovered the intrusion several weeks ago. On October 13, it began notifying the people affected.
What the Hackers Took
By Meta’s estimate, 99% of the stolen information was work material, mostly program code. Meta said the remaining 1% was personal data on about 1,500 people. Most of them were company employees in the United States.
The company has not yet revealed which categories of personal information the attackers obtained. It has also not disclosed the full volume of stolen code.
Why Personal Data Was on GitHub
Personal data should never have been on GitHub at all. Meta says employees added it to the repositories by mistake. In doing so, they broke internal rules.
However, much of the material that looked like real records was not real. It was synthetic or anonymized test data. Developers had created it to build and check software.
A Messy Mix for Attackers and Investigators
This mixture complicates any assessment of the damage. Meta believes the attackers may struggle to tell real records from test ones. Even so, the company is notifying regulators and the people affected. Victims have been offered credit and dark web monitoring. These services help them spot any misuse of the stolen information quickly.
No Product Flaw, No Internal Systems
Meta stresses that the attackers did not exploit a flaw in its products. They also did not reach internal systems. Access stayed limited to business data in GitHub repositories.
Meta investigated with GitHub. The company does not believe the attackers were originally hunting for its information. Nobody has publicly named the people behind the intrusion.
How Meta Responded
After the discovery, the security team shut out the outside access. It brought in GitHub and law enforcement. Meta then rotated the access secrets found in the affected repositories. In addition, it strengthened product protections to account for the risk of leaked source code.
The company is now building its next line of defense around the repositories themselves. Meta is adding restrictions to keep user information out of GitHub. It is also adding proactive scanning to catch data uploaded by mistake.
The investigation continues. For now, there are no public signs of a breach of internal systems or of an exploited vulnerability in Meta products.
