Meta disclosed this week that hackers broke into some of its internal GitHub repositories using a single employee's stolen account credentials, making off with source code and personal data belonging to about 1,500 people, most of them US-based Meta employees. The company confirmed the breach to SecurityWeek, which first reported the incident, and said it has notified those affected.
According to Meta's own account of the breach, cited by both SecurityWeek and Digital Today, roughly 99% of the material the attackers accessed was business data — software code tied to some of Meta's products — while the remaining 1% was personal information. Meta said that data should never have been stored on GitHub in the first place, and that it ended up there in violation of internal company policy. The company added that much of what looked like personal information was actually synthetic or anonymized test data, which it said would make it harder for attackers to pick out real records from fake ones.
A Single Stolen Credential
Meta has said an outside group gained access by stealing the account credentials of one employee, though it has not disclosed how those credentials were obtained, how many repositories were affected, when the intrusion began, or who was responsible. A company spokesperson said Meta's core internal systems were not compromised as a result of the breach. The company has not detailed what categories of personal information were exposed beyond characterizing most of it as belonging to US employees.
The disclosure lands amid a string of incidents this year involving source-code repositories at major tech companies, including a separate breach at GitHub itself in which attackers compromised an employee's device through a malicious VS Code extension and claimed to have stolen data from thousands of the company's internal repositories. Corporate GitHub accounts have increasingly become a target precisely because they sit at the intersection of proprietary code and, often inadvertently, the kind of employee data companies are supposed to keep walled off from engineering tools.
What Happens Next
Meta has confirmed the intrusion and notified the roughly 1,500 people whose data was involved, but it has not said whether it will offer them any credit monitoring or similar protection, nor has it detailed what, if anything, it is doing to prevent personal data from ending up in code repositories again. The company has left open several basic questions about the scope and timeline of the breach that outside researchers are likely to keep pressing it to answer.
