Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

An external threat actor gained unauthorized access to Meta's GitHub repositories by using stolen credentials from an employee. This access allowed the attackers to obtain mostly business data in the form of software code and a small amount of personal data, which was inadvertently stored in the repositories. Meta's investigation with GitHub and law enforcement concluded that the hackers were not specifically targeting Meta's data. Meta responded by revoking exposed secrets, implementing new controls to prevent accidental user data storage, and collaborating with GitHub on additional security measures. Notifications and credit monitoring services were offered to affected individuals.

The breach exposed business-related software code and a limited amount of personal data for about 1,500 individuals, primarily Meta employees in the US. The personal data exposure was minimal and included synthetic or anonymized test data, reducing the risk of misuse. There was no compromise of Meta's internal systems or products. The incident may have reputational impact and necessitated regulatory notifications and credit monitoring for affected individuals.

Meta has rotated all secrets found in the affected repositories and implemented new controls to prevent user data from being stored on GitHub. The company is working with GitHub to enhance repository protections and has hardened its product security to mitigate risks from unauthorized access. Affected individuals have been notified and offered credit and dark web monitoring services. No further action is required from external parties as this was not due to a product vulnerability and internal systems remain secure.