Meta is notifying about 1,500 people after attackers accessed some of its GitHub repositories using stolen employee credentials. Most affected individuals are employees in the United States.
According to SecurityWeek, the intrusion exposed software source code and a smaller amount of personal information mistakenly stored alongside business data.
The company detected the intrusion several weeks ago, terminated the attackers’ access, and engaged GitHub and law enforcement. Notifications to affected individuals began Tuesday.
Hackers Breach Meta’s GitHub Repositories
Meta is also informing regulators and offering credit monitoring and dark web monitoring services to people whose personal information was involved in the incident.
According to Meta, about 99% of the stolen material was business data, including software code associated with some of its products.
Personal information represented the remaining 1%. Meta has not disclosed the specific categories of personal information exposed or identified the affected repositories.
The company said storing personal information in GitHub violated its policies. A significant portion of material resembling personal records was actually synthetic or anonymized test data.
That mix could make it harder for attackers to distinguish real information from test records, although Meta has not established that this prevents misuse.
Meta emphasized that the incident did not involve a vulnerability in its products or a breach of its internal systems. Instead, attackers improperly accessed business information hosted on GitHub using compromised employee credentials.
The distinction places the disclosed entry point at repository authentication rather than exploitation of a Meta product. “This was not a vulnerability in any Meta product, and Meta’s internal systems were not breached,” a company spokesperson told SecurityWeek.
Based on its investigation with GitHub, Meta does not currently believe the attackers specifically targeted its data. The company has not publicly identified the responsible group or explained how the attackers stole the credentials.
Following containment, Meta rotated secrets discovered in the affected repositories. The company also hardened product security to address risks arising from the attackers’ access to business data.
It has not detailed those changes or disclosed whether attackers used any exposed secrets to access additional resources before Meta replaced them.
Meta is working with teams that use GitHub to prevent user information from being stored on the platform. As an additional safeguard, it is introducing proactive scanning controls to detect accidentally uploaded user data.
The response addresses both the unauthorized access and the inappropriate presence of personal records in development repositories.
“We’ve since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories,” the spokesperson said.
The disclosed response combines credential containment, repository safeguards, and tighter controls over sensitive information.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
