By Hamza Faisal
Meta is notifying about 1,500 people that their personal data may have been swept up in a raid on the company's GitHub repositories, after hackers got inside using an employee's stolen login credentials.
The disclosure came to light when a Meta spokesperson detailed the incident to SecurityWeek on October 13. An outside group had gained access to several of Meta's GitHub repositories and taken business data — mostly software code tied to Meta products — along with a small amount of personal information. Most of the roughly 1,500 people being notified are Meta employees based in the United States.
Not a product flaw, Meta insists
Meta is drawing a sharp line between this incident and a breach of its own systems. "This was not a vulnerability in any Meta product, and Meta's internal systems were not breached," a spokesperson told SecurityWeek. Instead, the company characterizes the episode as an account-security failure: the attackers improperly accessed business data held in a GitHub repository using the stolen credentials.
The company says it spotted the intrusion several weeks before the October 13 disclosure, cut off the attackers' access, and brought in GitHub and law enforcement to investigate. Notifications began going out on October 13. So far, Meta has not said who was behind the theft, or how the employee's credentials were stolen — whether through phishing, password reuse, or infostealer malware.
Data that should never have been there
About 99 percent of what was taken was business data — primarily software code for some Meta products. The remaining one percent was personal information that, by Meta's own rules, should never have been in those repositories at all. Someone had added the personal data by mistake, in violation of a company policy that prohibits storing personal data on GitHub.
Meta hasn't said which types of personal information the attackers obtained. It did offer one reassuring caveat: a significant portion of what looked like personal data was actually synthetic or anonymized test data, making parts of the stolen material less useful — though that doesn't eliminate the risk for anyone whose real information was exposed.
Notably, based on its investigation with GitHub so far, Meta said it does not believe the hackers were going after its data specifically — suggesting an opportunistic compromise rather than a targeted operation.
What Meta says it fixed
Since discovering the intrusion, Meta says it has rotated any secrets found in the affected repositories and implemented new controls to stop user data from landing on GitHub. It is working with its engineering teams to keep personal data off the platform and adding proactive scanning to catch accidental uploads before they become a problem.
The incident is a reminder that even at companies with world-class security teams, the soft underbelly is often a single set of credentials — and data committed to the wrong place by mistake. For the 1,500 people receiving Meta's notifications, the advice is familiar: watch for phishing attempts that reference the breach and treat unsolicited messages claiming to be from Meta's security team with caution.
By Hamza Faisal
