Meta Hit by GitHub Breach: Stolen Credentials, Leaked Code, and 1,500 People Notified

Meta is in the process of notifying around 1,500 people, mostly US-based employees, that their personal data was caught up in a breach of several of the company's GitHub repositories.

The attack was spotted a few weeks back. Hackers used stolen employee credentials to get into the repositories, which is exactly the kind of low-tech entry point that keeps security teams up at night. Meta's security team cut off the access, looped in GitHub, and called law enforcement. Notifications started landing in inboxes on Tuesday.

The haul was mostly code. Meta told SecurityWeek that around 99% of what the attackers took was business data in the form of software related to some of its products. The remaining sliver was personal data that, according to Meta, had no business being there in the first place. Storing personal information on GitHub apparently violates the company's own policies. Meta hasn't disclosed exactly what types of personal data were involved.

There's a small silver lining, if you can call it that. A notable chunk of what appeared to be personal data was actually synthetic or anonymised test data. So the attackers may end up holding a bag of convincing-looking junk they can't easily distinguish from real records.

Meta says it doesn't currently believe the attackers were specifically targeting its data, based on the investigation conducted with GitHub so far. That's either reassuring or beside the point, depending on how you look at it.

Affected individuals are being offered credit monitoring and dark web monitoring services. Regulators are also being notified.

In terms of the response, Meta rotated secrets found in the compromised repositories and says it has tightened product security off the back of the incident. It is now working with internal teams to keep user data off GitHub entirely, and adding proactive scanning controls to catch any personal data that gets uploaded by mistake in future.

"This was not a vulnerability in any Meta product, and Meta's internal systems were not breached," a company spokesperson said. The statement is technically true, but the fact that personal data was sitting in a GitHub repository it shouldn't have been in is its own kind of problem.

Credential theft plus misplaced sensitive data is a fairly avoidable combination. The controls Meta is now implementing probably should have been in place already.