Meta GitHub breach…stolen employee credentials expose source code, data on 1,500 people

Meta said outside hackers used an employee's stolen credentials to get into its GitHub repositories and take source code, along with personal data on about 1,500 people.

According to SecurityWeek on Oct 13 (US time), Meta detected the intrusion a few weeks ago, shut off access and brought in GitHub and law enforcement. It has started notifying those affected, most of them US employees.

Meta said 99% of the data taken was software code for some products and the other 1% was personal data. That data was added to the repositories by mistake, against company policy. A significant portion looked like personal data but was synthetic or anonymized test data, so the attackers may not be able to tell real records apart, Meta said.

A Meta spokesperson said it 'was not a vulnerability in any Meta product, and Meta's internal systems were not breached.' Meta rotated the secrets found in the repositories and is adding controls and automated scanning to keep user data off GitHub. Those affected are offered credit and dark web monitoring.