One Stolen Employee Login Let Hackers Into Meta's GitHub, Where They Took Code and Data on 1,500 People

Meta lost source code to a single stolen employee login. The company began notifying roughly 1,500 people on Tuesday, most of them US employees, that their personal information was exposed after hackers got into some of its GitHub repositories.

The way in was not exotic. An outside group logged in with an employee's stolen credentials. Meta detected the intrusion a few weeks ago, shut down the access and brought in GitHub and law enforcement.

Data that should not have been there

Meta says 99% of what the attackers took was business data, software code tied to some of its products. The remaining 1% was personal data, and that is the uncomfortable part. It had been added to the repositories by mistake, and storing it on GitHub broke company policy.

Meta has not said what kinds of personal information were involved. It did say a significant share of what looked like personal data was synthetic or anonymized test data, which means the attackers may struggle to tell real records from fake ones. Based on its investigation with GitHub so far, the company does not believe the hackers were specifically hunting for its data.

Meta is notifying regulators and offering affected people credit and dark web monitoring.

Meta's careful framing

The company's statement draws tight lines around what happened. "This was not a vulnerability in any Meta product, and Meta's internal systems were not breached," a spokesperson said. "Meta business data held in a GitHub repository was improperly accessed using an employee's stolen credentials. This included a small amount of personal data for a limited number of people, most of whom were Meta employees."

That framing is technically tidy, but repositories holding product code are not trivial assets. One detail in Meta's cleanup says as much: the company rotated secrets it found in the affected repositories, meaning credentials or keys were sitting inside the code itself.

What changed

Meta says it hardened product security against risks from the exposed business data, is working with internal teams that use GitHub to keep user data off the platform, and is adding proactive scanning to catch user data uploaded by mistake.

"We've since rotated secrets found in the repositories, implemented new controls to prevent user data from being stored in GitHub, and worked with GitHub on additional measures to protect our repositories," the spokesperson said.

GitHub keeps turning up as the soft spot in serious security programs. Just this month, an npm loophole that trusted GitHub repo names left more than 1,500 packages open to hijack. Meta's case needed no clever exploit at all. One valid login, plus repositories holding data and secrets that never belonged there, was enough to walk out of Meta with its code.

Some offers on this page may be paid placements or contain affiliate links.