Meta has revealed a breach of a GitHub repository that exposed software code and personal information belonging to about 1,500 individuals, most of whom are U.S. employees.
The company began notifying affected individuals on October 13, after discovering the intrusion several weeks earlier, which involved the theft of an employee’s credentials.
According to Meta’s statement to SecurityWeek, an external group used the compromised credentials to access the company’s repositories.
The security team subsequently terminated the unauthorized access and engaged with GitHub and law enforcement. Meta clarified that the incident did not involve exploiting a vulnerability in its products or compromising its internal systems.
The stolen material primarily consisted of business information. Meta estimated that 99% of the data taken was software code associated with some of its products, while personal information made up the remaining 1%. The company has not disclosed the specific categories of personal information exposed or the affected products.
The company mistakenly stored personal records in repositories, violating company policy. Furthermore, Meta indicated that a significant portion of the information that appeared to be personal data was actually synthetic or anonymized test data.
As a result, attackers may struggle to distinguish genuine records from test material. However, this uncertainty does not negate the confirmed exposure.
Meta’s investigation with GitHub has not determined whether the attackers specifically targeted the company’s data.
The information shared does not identify the threat group, explain how the employee’s credentials were stolen, or specify the authentication mechanisms involved. These gaps leave the initial credential compromise and the campaign’s broader context unresolved in the public domain.
To mitigate potential risks, Meta rotated secrets found in the affected repositories and enhanced product security in response to the exposure of business data.
The company also collaborated with GitHub to implement additional repository protections. However, it has not publicly detailed the secrets involved or the precise security changes made.
Meta is introducing further controls to prevent user information from being placed in GitHub repositories. It is also implementing proactive scanning to identify accidentally uploaded data, adding an extra layer of defense alongside its existing policies.
These measures address the improper storage of personal information that increased the impact of the credential-based intrusion.
Meta is offering affected individuals credit monitoring and dark web monitoring services and is notifying regulators.
This incident highlights two distinct failures: unauthorized access to the repository through stolen credentials and storing personal information in violation of company policy. Meta’s announced response aims to address both access protection and data-handling practices in the repositories.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
