Meta says hackers stole code and personal data of 1,500 from GitHub repositories

Meta has begun notifying roughly 1,500 people after hackers used an employee's stolen credentials to access some of the company's GitHub repositories and take software code along with a small amount of personal data, SecurityWeek reported on October 13. Meta said the incident did not involve a vulnerability in any of its products and that its internal systems were not breached.

What happened

According to SecurityWeek, Meta detected the intrusion a few weeks before the disclosure. An outside group gained access to the repositories using the stolen credentials of a Meta employee. The company's security team cut off the attackers' access, brought in GitHub and law enforcement, and notified regulators. Notifications to affected individuals began going out on Tuesday, October 13.

Meta described the event as improper access to business data in a GitHub repository using stolen employee credentials. Based on its investigation with GitHub so far, the company said it does not believe the hackers specifically targeted its data. Meta has not identified the group responsible, and SecurityWeek's report does not say how the employee's credentials were stolen.

What data was taken

Meta said about 99% of the data taken was business data, mainly software code for some of its products. The remaining 1% was personal data that had been stored in the repositories by mistake, contrary to company policy. Meta has not said what types of personal information were involved. The company also noted that much of the apparent personal data in the repositories was synthetic or anonymized test data, which may make it difficult for the attackers to separate real records from test records.

Who is affected

Most of the roughly 1,500 people being notified are U.S.-based Meta employees, according to SecurityWeek. Affected individuals are being offered credit and dark web monitoring services. There is no indication in the report that Meta's billions of platform users were affected.

What to do

Meta said it rotated secrets found in the affected repositories, implemented new controls to prevent user data from being stored in GitHub and worked with GitHub on additional protections. It is also adding proactive scanning to detect user data uploaded by mistake as a second line of defense.

The incident is a reminder for organizations to protect developer accounts with phishing-resistant multi-factor authentication, keep secrets and personal data out of source code repositories, scan repositories for exposed credentials and rotate any secret that may have been committed. People who receive a notification from Meta should enroll in the offered monitoring and stay alert for targeted phishing.